• On The Insider: Holy Cleavage!

June 1, 2007 6:15 PM PDT

Apple criticized for embedding names, e-mails in songs

A correction was made to this story. Read below for details.

It used to be that music fans believed cryptic messages about Satan or the death of a band member were hidden within rock albums.

Nowadays, the secrets buried in digital music are way too easy to find, according to the Electronic Frontier Foundation (EFF). The consumer watchdog group, which focuses on the Web, is taking issue with Apple's practice of embedding customer information within iTunes music.

Apple includes customer names and e-mail addresses within song files purchased from iTunes, according to Fred von Lohmann, an EFF attorney. Several tech blogs wrote about the embedded information this week after Apple launched iTunes Plus, a service that features music stripped of controversial copy-protection software.

Von Lohmann pointed out that data could easily be compromised if an iPod is lost or stolen.

"It's not as bad as losing a credit card number," von Lohmann said, "but it's still information that people wouldn't want floating around out there--especially without them knowing about it."

Apple hasn't said why the company would leave customer information exposed. But some observers have speculated that Apple is adding watermarks to music files. Watermarking describes the practice of inserting identifying information into digital files so they can be tracked. Privacy groups frown on such practices, but von Lohmann doubts that these were Apple's intentions.

Mike Goodman, a Yankee Group Research analyst, argued that watermarking is "certainly better than digital rights management.

"Watermarking does not treat the consumer like a criminal," Goodman said. "DRM is also restrictive, telling you how many times you can play a song or which device it can be played on. Watermarking works on the assumption that a consumer is innocent but provides the industry an opportunity to catch someone that breaks the law."

Ars Technica and Tuaw earlier reported on the personal information within iTunes' music.

 
Correction: This story erroneously reported that Apple had in the past encrypted personal information of iTunes customers embedded within music files. The data is available in clear text.

See more CNET content tagged:
Apple Computer, Apple iTunes, personal information, digital-rights management, practice

Add a Comment (Log in or register) 110 comments
Please don't complain!!!
by afolgueira June 1, 2007 6:38 PM PDT
This is not new, any song you purchase from iTunes comes with your name, email etc. What do you guys want to do??? make money off this free music and don't be responsible for it. ahahah
Reply to this comment
Don't you think
by suyts June 1, 2007 6:57 PM PDT
there is a better way?
View reply
Apple assumed to have goofed?
by foomonkey249702348 June 1, 2007 6:42 PM PDT
Wait -- Fred von Lohmann assumes Apple just goofed here?

You got to be kidding.

Is Fred/EFF so naive? Oh right, they have their own agenda.
Reply to this comment
DRM'ed iTunes songs not encrypted
by totorototoro June 1, 2007 8:05 PM PDT
The DRM'ed (.99 cent) songs don't have the emails or customer names encrypted either. I can see that information, including on iTunes songs I don't have authorization to play. (my wife bought them with her account, and I don't have this computer authorized to play them, but I can see her name and email)
Reply to this comment
Some people will never be happy
by Riquez-001 June 1, 2007 8:22 PM PDT
OK, so the song you own & you paid for on your computer has
some encrypted info in it that can identify you - a bit...

Big fkin' deal.

You also have your details in your address book file on your
computer & in the CV you wrote in Word. The cookies saved by
your browser have your usernames & password in them. The
countless emails you have backed up all have intimate details
about your life.

Since it would be illegal to share/sell the music file you own, you
really have no problem do you? I mean, you wouldn't put your
browsers cookies on bittorrent would you?

Everyone has moaned that Apple's DRM is a bad thing & ranting
"I will never buy iTunes music until they remove the DRM!"
OK, so now they remove it & people still need to complain about
it - "you have to pay 20p! outrageous! It's only 256 bit, i wanted
512 bit! Ripoff!"
It seems that the same people were saying "I will never buy a
Mac until it can run Windows & has a 2 button mouse" - OK, so
now it does (& has) they have to find another stupid reason to
complain.

Give me a break you moaning b'stards. This a great moment in
the history of online music & your getting a great deal. It's
exactly what we've asking for - hurray!
Stop complaining about a trivial stuff & enjoy your DRM free
music.
Reply to this comment
Agree completely.
by coolfactor June 1, 2007 8:42 PM PDT
Apple hasn't done anything different with the name and email address than what it's been doing for the past 2.5 years. They've just re-encoded at a higher bit rate and without DRM. That's it! Get over it people.
Agree
by afolgueira June 1, 2007 8:33 PM PDT
People complain about windows, they complain about mac os x, they complay about everything when the first thing they should do is complain about their complaining, ahhaah .
Reply to this comment
Odd...
by Amazingant June 1, 2007 8:43 PM PDT
I just checked, and I noticed that I can open the old DRM files in Notepad (although it takes forever to load) and my full name, email address, and everything else you can see from the iTunes info screen is in there in plain text. This information can't be that encrypted if it can be read through a standard text editor.

So, what was the problem with the new files?
Reply to this comment
My question is why?
by unknown unknown June 1, 2007 8:58 PM PDT
It certainly not for anti-piracy cause if it's laughably easy to get around. Re-ripping it would do it, that and it's not hard to strip audio data out of the mpeg4 container format and rebuild it sans ID information.
Reply to this comment
Also
by MSSlayer June 2, 2007 12:01 AM PDT
It is trivially easy to encode some random name and email address into AAC and MP3 files and flood the P2P sharing networks, making this completely pointless.

There is absolutely no reason for this, therefore there is no reason it should exist.
View reply
Because
by GGGlen June 2, 2007 11:06 AM PDT
Even though you're making the EXACT SAME POINT iTunes
supporters have made for the LAST FIVE YEARS, legions upon
legions of Mac Haters have said "Ohhh!!! It's SOOOO HARD to re-rip
a file that WE HATE APPLE for forcing us into it!
View reply
Quit Complaining!
by LarryLo June 1, 2007 9:16 PM PDT
I am amazed by the response to this. Its a Watermark it means its your file.

Everyone and their mother has cried and screamed for DRM Free Music, so that you could play "Your Music" on any device you want, whenever you wanted...well now you have it. So what if Apple embeds some watermark in it? If you are not sharing the files you have nothing to worry about. If you are really paranoid convert them to another format, or burn them to a CD an rerip them.

This criticism is just silly, we finally get what we want, and just cause they stuck our name on our file people are getting their panties in a bunch?

You don't like it, buy a Zune!
Reply to this comment
I didn't get what I wanted
by MSSlayer June 2, 2007 12:02 AM PDT
Where is the uncompressed high quality music files?

Where are the music files that contain nothing more then music.

There is no reason for this, nor any valid excuse.
View all 3 replies
Who cares!
by michaeljmac June 1, 2007 9:55 PM PDT
You know if you don't illegally share those files with other people,
noone but the purchaser has that information. Oh no, my own
name and email on my computer, what a horrible thing. The only
people that care about this is people who want to illegally share
these files.
Reply to this comment
Exactly, Who Cares?
by Bellette June 1, 2007 10:06 PM PDT
Get over it,

This information is in my local telephone book for goodness sake.
Let's not sue every last person on Earth over rubbish like this.
really?
by MSSlayer June 2, 2007 12:04 AM PDT
So if someone hacks your computer and decides to share your files, you will be willing to take responsibility for it?

It is amazing how few people grasp legitimate privacy and security issues.
View all 4 replies
No big deal ...
by sdai June 1, 2007 10:02 PM PDT
so people are used to expose everything personal at MySpace yet they're shy from sharing their emails? LOL What are these people smoking???
Reply to this comment
Fair Use
by Freiheit13 June 1, 2007 10:30 PM PDT
"but it's still information that people wouldn't want floating around out there--especially without them knowing about it."

If you're not illegally sharing your files with others, this information would not be "floating around out there". If I buy tracks on iTunes and play them only on devices which I own then no one else is ever going to see my name and email address in them. I think it's perfectly legitimate to put this in as a deterrent to illegal sharing in a way which in no way whatsoever affects legal fair use by the purchaser.
Reply to this comment
Yes it can
by MSSlayer June 2, 2007 12:08 AM PDT
Especially if you are storing them in a windows machine.

Lets see how much these anti-whiner whiners whine when their machines get hacked and their music files that pointlessly and stupidly contain private information gets spread around and not only do you get an avalanche of spam, ans also, the RIAA comes knocking on your door with a $10000 lawsuit against you.

Lets see how little you care, when people embed your name and email in files not even yours and the same things happen.

Seriously, there needs to be a battery of tests required before you are allowed to operate a computer.
View all 2 replies
RE
by unknown unknown June 2, 2007 1:26 PM PDT
I doubt this is going to stop or even be a deterrent to file sharing since it's trivial to get around or remove. Since the mpeg4 format is divided into sections or "atoms" that have a name and length removal is easy.
Hell Is Freezing Over
by anassassinoftime June 1, 2007 10:42 PM PDT
By and by, this story has probably seen the most intelligent
forum comments ever! It's rare this day and age to see an entire
thread of mostly-sensible responses.

To reiterate the points that have already been stated: the big
story here is that you can now download DRM-free music legally
and efficiently.

So they embed your name in a file you purchase? Big deal. DRM-
free music is about fair use, and fair use doesn't include
distributing your music to the general population.

As for "losing an iPod" - I'm sure most iPods are full of personal
information such as name, etc. Having the users name
embedded in the audio files is trivial at best.

Quit whining and enjoy what you now have: a legal means to
acquire DRM-free music!
Reply to this comment
My thoughts exactly...
by CentrOS June 2, 2007 6:08 AM PDT
Nothing more to add.
People are getting more dumb by the minute
by MSSlayer June 2, 2007 12:09 AM PDT
People have no clue how much damage this can cause.
Reply to this comment
Nope
by GGGlen June 2, 2007 11:22 AM PDT
Reasonable, educated, intelligent people disagree with you, and
you're getting hysterical.
At 1st, I thought it was funny, but I'm becoming a little concerned
for your mental health.
Back away from the forums for a day ot two, take a deep breath,
buy a Zune (where I'm sure you'll find True Happiness), and check
in with us later.
View reply
Seriously true
by Vegaman_Dan June 4, 2007 5:24 PM PDT
And with the Apple iPhone about to go live, this data will have yet another vector to get loose. It's an unacceptable security risk and unthinkable that a company would do this, especially one that has been so user focused in the past.

Hopefully they will correct this oversight and we'll all blissfully forget these issues.
No privacy violation if you don't give away the music
by esbeale June 2, 2007 12:32 AM PDT
Anyone who thinks this is an invitation of privacy isn't thinking
rationally (or frankly doesn't care). If you don't give away the music,
then your privacy has not been invaded as no one will ever see your
info. If you give away the music, then you have committed a crime,
and you have voluntarily waved your privacy rights. DRM-free
doesn't mean responsibility free.
Reply to this comment
Thank you!
by tahoerob June 2, 2007 12:07 PM PDT
Finally, someone thinking rationally. The only people who worry
about this are the people who are breaking the law. It seems a very
reasonable trade-off in my mind for enjoying the ability purchase
DRM-free music. I wish the EFF and others would stop hiding
behidn the "privacy" issue in an effort to defend illegal filesharing.
It's getting old.
View reply
And if it's lost or stolen?
by Vegaman_Dan June 4, 2007 5:28 PM PDT
If you buy a new car from the dealer and then it gets stolen, no big deal, right? Well, other than it was stolen, of course. No identity theft issues there to worry about though.

Now imagine if the dealer had put all your personal information inside the trunk and had never told you that they did this on all their cars they sold. You *thought* it was all secure, but now you learn that the dealer has now delivered your information to those who want to do you harm.

That is simply irresponsible by the dealer. The fact that they never told you this until it was too late is even more so.
What if some "friend" borrows Watermark songs then Use P2P Website
by osxxp June 2, 2007 12:59 AM PDT
What if some "friend" uses your computer to email himself/herself
one of the Watermarked songs . . . then uses a P2P Website to
"share" it. Your name & email Watermark could end up in the hands
of hundreds (thousands?) of file sharing users.

That scenario makes me uneasy.
Reply to this comment
They your "friend" is a jerk
by chassoto--2008 June 2, 2007 7:03 AM PDT
There's another word I'd use, but it will get flagged ;)
"Borrow"?
by michaeljmac June 2, 2007 8:17 AM PDT
What exactly are you talking about here? Borrow? What does that
mean?
Secure Your Computer?
by `WarpKat June 2, 2007 10:19 AM PDT
Hello? Did we miss the most important lesson of owning a computer? It's like owning a dog.

You have to take some personal responsibility in having it. Create a guest account that anyone can use but is so completely restricted that it can't view any files other than what is necessary to conduct whatever business they need to.

Most people won't bother and it's those people that will have the toughest time in proving they are not in willful violation of any contract or law.

If you want to be lazy and not do that one simple thing, then you deserve to have your computer ransacked by your 'friend.'
View reply
That could never happen
by MSSlayer June 3, 2007 2:33 PM PDT
Because the idiots on this site say it isn't a problem.

That is one of dozens of realistic and probable scenarios that will happen because of the stupidity of Apple.
borrow = steal?
by skeptik June 4, 2007 7:17 AM PDT
If your friend "borrows" your song and posts it, you're guilty of assisting theft twice - giving to your friend and spreading to the internet.

Should you be fined or go to jail for this? Hell no.
But your scenario for justifying your protest is invalid because it isn't legal to begin with.
Complaints about "watermarks"
by bignumone June 2, 2007 3:39 AM PDT
They could have hidden it. They should have encrypted it.
They would have had they know about it.
Could have, should have, would have?
Can you really complain? This is so much better than having
someone tell you how you can use the music and how many
times you can play it. And given how much people "borrow"
music and how long they "borrow" it, can you blame them for
marking it in a way that ties it to the original owner?
It all comes down to this; copying music and giving it away is
stealing. Do you do your job for free? If you don't like the price
for what you are getting, don't buy any of it. The artists and
recording companies will lower the price to meet market
demand.
Reply to this comment
Should be easy
by ktemplar June 2, 2007 6:42 AM PDT
I havent looked at this myself yet, but if the information is so easily viewable in a text editor I would suspect that it would take about 15 minutes for me to write a perl script that I could use to scrub my info from any music I buy from iTunes.
Reply to this comment
Agree with ya
by afolgueira June 2, 2007 7:36 AM PDT
People that care about this are those who want to do something iligal with this.
Reply to this comment
lol
by MSSlayer June 2, 2007 8:48 AM PDT
If you have nothing to hide, why should you care?

What a tired, unintelligent argument.
View reply
Just Relax and enjoy the music on other devices
by afolgueira June 2, 2007 7:40 AM PDT
This is great, NOw i can play this music on my 360, or any other WMP device.
Reply to this comment
Misleading! Old iTunes files have this too!!
by Dr Dude June 2, 2007 8:31 AM PDT
I also checked an older .m4p track that I bought from iTunes over a
year ago. I opened it in TextEdit and my name and email is clearly
visible.

Old news, just tring to **** on Apple's parade.

Move along folks., nothing to see here.
Reply to this comment
 See all 110 Comments >>
advertisement

Latest tech news headlines

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.

More feeds available in our RSS feed index.

Markets

Market news, charts, SEC filings, and more

Related quotes

Apple (1.86%) 1.69 92.70
Dow Jones Industrials (-0.31%) -27.24 8,742.46
S&P 500 (0.34%) 3.08 909.73
NASDAQ (1.12%) 17.95 1,617.01
CNET TECH (0.75%) 8.48 1,141.83
  Symbol Lookup
advertisement

Inside CNET News

Scroll Left Scroll Right