Content protection

[TongMuan]

Starting a new thread, as the previous discussion about Ovi Store DRM has been locked.

The last comment in the old discussion is from wizard_hu_:
"I do not think that anyone would really spend much time on removing ads from fully functional, free applications."

That just happened to my Symbian application, only a few days after the release in Nokia Store. The free version is fully functional, but has a nag screen, with a link to purchase the paid version, when exiting. Googling with the application name, I found a version of the app with the nag screen removed and Russian translation (!). Also, there seems to be an unofficial Turkish translation out there.

However I don't see this kind of distribution as much of a problem, because the sis contents are modified and the original signing is no longer valid. This means that the users need a devcert or a hacked phone to install the packages, which rules out most ordinary users. Also, I even think it's quite cool that someone likes the application so much that he/she goes through the effort to translate it to another language

What I see as a big problem (as also stated by many in the original thread) is that it's so easy to take the original, signed sis files from Nokia store and freely distribute them. Anybody with Nokia Suite can install the app by simply double-clicking the file.

I'm wondering if it was at any point considered that the application sis files would be signed with the downloader's IMEI during the download process? This could maybe be done at least for files that use the Store's free signing, with Nokia provided UIDs. Symbian Signed website can be used to create devcerts without waiting, and no separate certificate installation is needed for those, so I don't see what the technical issues would be (except maybe more processing power needed for signing, and not being able to use the device web browser to download even free applications from Store, but who does that anyway?).

I'm not really expecting this kind of huge change to happen at this point, but just posting the idea for discussion.

[Johnny_B]

Hacking seems to be really a problem. One of my apps from the Nokia store was available UNSIGNED on several shady websites just a few days after it was published.

[yuelongr]

You have a few days, but my app was hacked almost on the same day, google it has many thousands after one day...

[wizard_hu_]

That just happened to my Symbian application, only a few days after the release in Nokia Store. The free version is fully functional, but has a nag screen, with a link to purchase the paid version, when exiting. Googling with the application name, I found a version of the app with the nag screen removed and Russian translation (!). Also, there seems to be an unofficial Turkish translation out there.

Cool Anyway, I guess here the extra content justifies the effort. Someone spent time to create the translations, removing the exit screen is reduced to a relatively small extra work. Perhaps he did not want to spend time on translating it too...

However I don't see this kind of distribution as much of a problem, because the sis contents are modified and the original signing is no longer valid. This means that the users need a devcert or a hacked phone to install the packages, which rules out most ordinary users. Also, I even think it's quite cool that someone likes the application so much that he/she goes through the effort to translate it to another language

I agree, this part is not too worrying. You can even consider 'stealing' the translation, just do some minor verification (Google Translate or similar thing). Perhaps you can also find a Russian description for it

What I see as a big problem (as also stated by many in the original thread) is that it's so easy to take the original, signed sis files from Nokia store and freely distribute them.
...
I'm wondering if it was at any point considered that the application sis files would be signed with the downloader's IMEI during the download process?
...
I'm not really expecting this kind of huge change to happen at this point, but just posting the idea for discussion.

Yes, these kind of ideas always have been circulating in the related threads. I am afraid, given the 'future' of Symbian it is really unlikely that anything would change.

[vereal]

Hi guys.
I also faced the content stealing problem. DRM protection is removed elementary.
Looking for other solution, i found that some applications (eg Skype) when downloading from the store are encrypted with AES128 for the phone's IMEI!!!
But there are no any encryption options in the publisher section.
Andrew Nokia, can you comment this? How to turn on encryption for our content?

[onedeveloper]

Hi guys.
I also faced the content stealing problem. DRM protection is removed elementary.
Looking for other solution, i found that some applications (eg Skype) when downloading from the store are encrypted with AES128 for the phone's IMEI!!!
But there are no any encryption options in the publisher section.
Andrew Nokia, can you comment this? How to turn on encryption for our content?

Have you tried in-app purchase for paid content? It should have strong encryption. I wonder if it is cracked already?

[pixsta]

Have you tried in-app purchase for paid content? It should have strong encryption. I wonder if it is cracked already?

The problem with IAP is that the content is decrypted after purchase. And if your phone is hacked, you have access to these private decrypted content files.
I have also tested IAP but I am not convinced yet due to "strange" behavior (also of the IAP test app), e.g. sometimes the communication with the IAP server providing the list of available items to buy seems unreliable.

[Maveric]

Hi there,

Thank you all - vereal, onedeveloper, pixsta - for your notes and comments, good points and findings. I will see that we get any open / possible unclear items regarding answered accordingly.

Any updates will appear to this thread.

Have a great weekend all,

Best Regards,
Marko

[vereal]

Yesterday was published a new version of my paid app in the store.
In the evening stolen file is already all over the internet.
Thanks NOKLA very much for the content protection and support for publishers!!!

[onedeveloper]

Yesterday was published a new version of my paid app in the store.
In the evening stolen file is already all over the internet.
Thanks NOKLA very much for the content protection and support for publishers!!!

Try in-app purchase. All our previous paid apps were distributed freely within one day from publishing, but in-app purchase content doesn't have any cracks even after a week. Surely our sis-file is available from various websites but none of them have paid features enabled.