Personal data found hidden in iTunes tracks

Times Online ^ | June 1, 2007 | Rhys Blakely

[my_pointy_head_is_sharp]

Names, e-mails and other sensitive information embedded in files

Fresh privacy fears have been sparked after it emerged that Apple has embedded personal information into music files bought from its iTunes online music store.

Technology websites examining iTunes products discovered that personal data, including the name and e-mail addresses of purchasers, are embedded into the AAC files that Apple uses to distribute music tracks.

The information is also included in tracks sold under Apple’s iTunes Plus system, launched this week, where users pay a premium for music that is free from the controversial digital rights (DRM) software that is designed to safeguard against piracy.

[Petronski]

Anybody surprised by this, stand on your head.

[Swordmaker]

If it wasn’t for Apple no one would be able to get your name or email address! /s

Well, Gee, if someone stole your music, wouldn't you want a finder to be able to identify you as the owner and send it back to you?

[martin_fierro]

	iPod
Send FReepmail if you want on/off iPing list WARNING: This is a high-volume Ping list. Turn your headphones down
The List of Ping Lists

...but I have an iPod Privacy Filter!!!

[Star Traveler]

This will be real popular.

It's been "that popular" since iTunes started, back in May of 2003. When I got the first songs back then, it had my name and e-mail address on every song purchased. That's how they knew they were my songs, versus someone else's songs and that they were to be played on my computers versus someone else's computers.

Nothing has changed since the iTunes store was opened in 2003 to now. It's the same name and e-mail address, which has been visible and plainly seen in the "info box" inside the iTunes program. Anyone who has ever used the program has been able to see it. If you haven't seen it, you simply have not been using the iTunes program.

What they have done now is not add your name -- not at all. It's been there all along. What they have done with EMI is simply remove the DRM. The rest remains the same, as it was since the beginning of the iTunes store and purchasing music online.

Regards,
Star Traveler

[Swordmaker]

Purchasers' mail addresses and names found in iTunes tracks... PING!

Interesting, if true...

If you want on or off the Mac Ping List, Freepmail me.

[SamAdams76]

I bought something online the other day and my name and address were right on the package where anyone could see!

The conspiracy is even worse than that! I bought something on Amazon.com the other day and my name and address automatically popped up! They didn't even have to ask me where I lived. They ALREADY KNEW!

[Star Traveler]

Do any other computer jukeboxes (Windows Media Player, RealPlayer, Winamp, etc.) do anything like iTunes is doing as described in this article? If they don’t, then they should adverstise the fact that they violate the privacy of their users.

You obviously have not used the iTunes program or the iTunes Online Music store. Since the online music store started around May of 2003, the purchasers name and e-mail address have been clearly visible in the Info Box of all songs. The only way that you could not have known that is simply because you've never used it before. Anyone who has used it or purchased just one song, knows that already. And they've known that from way back when, in 2003.

You have to be known as the "purchaser" if it's a song that is going to be used on your computer. You designate a computer that is "yours". Well, you (as a purchaser) have to be identified, in order to play on a machine ("computer") that you designate (or iPod, or other playing device). Thus, the first ingredient to being able to go to many different playing devices and/or computers is going to be an "identity" that is "you". Thus, you are identified on each song track as the "purchaser". And futher, the "account" is made simple by designating it as an e-mail address (and that e-mail address does not have to be valid, either, to continue to use it).

Thus, from the very beginning, in order to be able to move your songs that you own, around from machine to machine and playing device to playing device -- you are identified by name and account.

I suppose, if someone wanted to, it would be entirely possible to give Donald Duck as a name and some cryptic e-mail address that doesn't exist. That would be a possible scenario for those who are too paranoid to exist in this world, I suppose... But, then, only "Donald Duck's" computers would be able to play your songs. But, that would be fine if you don't mind being Donald Duck.

Regards,
Star Traveler

[Star Traveler]

Interesting, if true...

It's always been true. Just look in the info box of any purchased iTunes song. The purchaser's name and account are there (name is the purchaser's name as given, and the account is the e-mail address as given). As I was saying to another user, you could make it so that you are Donald Duck, if you don't want to give out your name and put any e-mail address in there, if you don't want to give a true one.

Regards,
Star Traveler

[Swordmaker]

It's always been true.

Thanks, Star. I thought that was the case. This article and one other that I saw make the implication that the information is hidden... one headline even suggested that steganography was used to imbed the information in the iTunes file.

[Star Traveler]

Nope. But Apple IS another source to be shut down.

Well, you've got that one wrong, I see...

In this case, it's not Apple who is distributing the purchaser's name and the account name (i.e., name and e-mail address). That is done at the user's computer, not at Apple, by means of the iTunes program on the user's computer. When your download is completed, your own iTunes program places your "ownership mark" on your song.

Now, if this gets "distributed" -- it's not Apple who sends it around to others -- it is the end-user who would be the one who would send it around to others. Your name and address is your proof of ownership of the song. If you decide to "pass it around", then you are the one who is distributing your own information to others and not Apple who is doing it...

Regards,
Star Traveler

[Star Traveler]

Apple should team up with Sony and start a new company called “Screwed R U”

Actually, Apple has been at the forefront of working for the consumer, rather than against the consumer, like Sony or the other RIAA members have been doing.

Apple is the one who has made it possible from the very beginning to strip off the DRM that the RIAA required Apple to put on all their online songs that they sell. Apple made it possible for any user to do that simply by burning a CD of that song. That's all it took and the DRM went "poof!!" and was gone. It has been that way from the beginning of selling the songs online, at the iTunes store.

And that was also the way that Apple made it easy for owners of the music (that they bought from Apple) to transfer their music to any other device that they wanted, with no restrictions.

AND NOW..., Apple is working further, on behalf of the consumer to get the RIAA members to remove their requirements for DRM, in the first place. They've already succeeded with the one company of EMI and Apple predicts that a full 1/2 of their entire catalog should be DRM-FREE by the end of this year. That's Apple's prediction, given just recently.

So, I would say that we consumers are greatly benefitted by Apple's entry into the online music sales business. If it weren't for Apple, this would be a lot worse scenario for users than we see right now.

Regards,
Star Traveler

[rxgalfl]

You know, it was quite clear for any iTunes purchaser that the songs were protected. I sent an iTunes purchased song to my sister-in-law via email and she asked me for my iTunes account and password. This is when she informed me, to my puzzled “Why?” that is required for her in order to play the song! It made sense to me then however I had no problem copying my purchased to DVDs or CDs. I see no problem with this unless you are willing to break the law and illegally share your files. You assume this risk anytime you allow your files to be downloaded by others...So all this whining is irrelevant to me! I will keep purchasing off iTunes.

[Star Traveler]

Thanks, Star. I thought that was the case. This article and one other that I saw make the implication that the information is hidden... one headline even suggested that steganography was used to imbed the information in the iTunes file.

Now that would be two different issues. The one issue of the name and e-mail address of the user/purchasher is not something new. It's been in place from the very first song ever sold at the iTunes Music Store. It's something that is easily visible by anyone who has ever looked at the info data of their songs. You can't miss it. So, that's no surprise.

The other "possible" issue of some watermark being put in a song that identifies you as the purchaser is not something that is visible or identifiable by others. That sounds like a possible mechanism to identify violators of copyright by seeing who is blasting out their copies of songs onto the Internet, via P2P systems.

Now, since the real issue of doing away with the DRM is for purposes of being able to easily move the song around to different devices and being able to make backups and not be encumbered by DRM hassles along the way -- then having a watermark should present no problems to those kinds of people.

But, to those who wish to violate copyright and simply blast the songs out to thousands of people, then the watermark would present a problem to them. However, that kind of "action" has never been allowed or condoned. The argument against DRM is in terms of how it hampers legitimate users and not how it hampers illegal activities. So, I can't see how one could complain about watermarks inside songs which would identify who is blasting out thousands of copies of songs to thousands of other people for free. No one is saying that this should be a "right" for others to do.

Regards,
Star Traveler

[TommyDale]

Yeah, they are freaking marketing geniuses.

[Star Traveler]

You know, it was quite clear for any iTunes purchaser that the songs were protected.

Yes, that was always made clear from the beginning. And the method for doing the "protection" was to apply the DRM ("Fairplay" by Apple), by means of your name and e-mail address. And the DRM was something that was required by the RIAA and not by Apple. We can see that now, as Apple is leading the way to removing the DRM from these songs. And that's a move that I would agree with, as opposed to the RIAA's stance on the issue.

I sent an iTunes purchased song to my sister-in-law via email and she asked me for my iTunes account and password. This is when she informed me, to my puzzled “Why?” that is required for her in order to play the song!

Now, there is where you run into problems with the DRM that the RIAA has required Apple to implement. You see, if you give other people the account name and password, you lose your ability to use your songs on any of your other computers. You only are allowed to use your songs on a fixed number of computers and devices (including all the iPods you may have), and once you go past that number, you are locked out of using those songs and/or music video or TV programs anywhere else. So, if you have a laptop, a desktop, an iPod and an Apple TV box, you're gonna run out of available devices that you can play your stuff on, if you start handing out your user name and password.

In addition to that, once someone else has your user name and password, they can start ordering new songs on your account, via their iTunes program on their computer, too. And you get to pay for their songs. That's not such a good deal, either.

So, there are problems with using DRM (as the RIAA requires) for these things. That's why Apple wants to get rid of the DRM. It's a hassle and a problem with how people want to use their equipment.

It made sense to me then however I had no problem copying my purchased to DVDs or CDs. I see no problem with this unless you are willing to break the law and illegally share your files. You assume this risk anytime you allow your files to be downloaded by others...So all this whining is irrelevant to me! I will keep purchasing off iTunes.

You can end up having a problem, though, even though you don't have one now. It can happen when you have taken up all the "slots" available for devices and computers (and maybe a couple of friends), and then you have one of the computers or devices fail and you have to replace it. And then, all of a sudden, you find out that you can't play your songs on your new device, until you de-authorize the failed device first. But, since it failed, you can't "de-authorize" it. You have to cancel all your authorizations and then add them all back in again. That's sort of a problem, although you can get around it by doing a bit of work. But, some people think it's more work than needs to be done, if you didn't have to contend with the DRM in the first place.

And then, you may just want to carry around a CD of song files and play it in other devices, and you'll find that this CD won't play on other devices. So, you're up a creek there, too.

And then, you may want to transfer your songs over to another device which doesn't have the same kind of DRM authorization scheme that Apple does, and so you're out of luck there, too.

There are all sorts of problems that you can run into with the DRM authorization that RIAA wants us all to go through -- and so that's why it's good that Apple is working for the elimination of all this DRM and making all their songs to be DRM-FREE from now on. I'm all for that. I figure that this will make the iTunes Music Store all the more popular, if they convert their entire library of songs to DRM-FREE, which is what they are intending to do.

Regards,
Star Traveler

[rxgalfl]

Luckily, I have yet to run into these problems. And yes, I am an Apple user. I got my first iMac in 1999 as a gift and I never went back to Windows (unfortunately I am forced to use them at work). I am not an Apple snob, I just embraced Apple due to its features, easy use and performance. To the day I have yet to run into a “blue screen of death” or anything at all which required me to reboot the ‘puter. I am just a happy and satisfied Apple user.

[TheBattman]

Since when can you not copy your purchased music where you want it? You have a couple of options:

1. simply set up your itunes to share and you can have the music on up to 5 machines/devices.

2. Burn your music to CD and simply rip it on the machine/device you want it on.

I am certain that there are some other more creative means to share your music as well.

Now - this revelation of personal data encoded in the files - now that does not make me thrilled.

[TheBattman]

You can say that again....

Oh - wait, you did!!! hehehe

[TheBattman]

I’ve got a question... how exactly is your name and email address embedded in your purchased a security risk? That is, of course, unless you are sharing your files with people you don’t trust...

[donnalee]

I understood the copy protection is in the new DRM-free songs which cost more(as well as the reg. itunes). No big deal to me, if I pay for them, someone else can buy their own! I got my info here: Apple conceals buyer data in DRM-free iTunes tracks Buyer's account, e-mail also found on iTunes files