17 ms·
SpotifyKeyDumper – Dump song decryption keys from the Windows Spotify client
- sdfhbdf 6y agoInteresting project although the drawback seems to be that the maintenance is pretty high since it uses the hardcoded memory addresses to dump the key for each Spotify version. I understand it requires from the maintainer after each update, which are frequent since Spotify has a well-developed Continuos Delivery [0], to reverse engineer the memory address and commit it to this repo. [0]: https://www.youtube.com/watch?v=5Ycb7jlZGkU https://www.youtube.com/watch?v=5Ycb7jlZGkU
- yjftsjthsd-h 6y agoIf picking up memory addresses can be automated, then would be fairly hilarious to put that into a CI system so that Spotify automatically pushes to release... and then this immediately automatically pulls it and builds a release to match:)
- Orphis 6y agoSpotify can also chose to prevent older clients to connect and only allow the latest one with new protections rendering this attack useless.
- gruez 6y agoWhat happens after you dump the key? Is there a corresponding tool to download and decrypt the tracks?
- m00dy 6y agothe key is for AES cipher which is a block cipher. So, I think the tracks should already be in filesystem.
- clashmeifyoucan 6y agoI think you need to intercept the network request then decrypt it using the key.¹ Can be automated I guess, not sure if someone has done that yet however. [1]: https://gitlab.com/fuck-capitalism/spotifykeydumper/-/releases https://gitlab.com/fuck-capitalism/spotifykeydumper/-/releas...
- bootloop 6y agoI would imaging the cached files work too.
- templeofhylia 6y agoyou use a program called Fiddler (Classic) to intercept the network request to the file while it plays which allows you to download the song, and then you decrypt it. there's instructions on the GitLab page as well as a Youtube guide that provide more detail.
- tbrockman 6y agoNot quite as user-friendly with regards to exposing the keys, but if you're interested in learning Rust you can check out the reverse-engineered protocol and access already decrypted audio streams using librespot: https://github.com/librespot-org/librespot https://github.com/librespot-org/librespot
- Retr0spectrum 6y agoThey're not already-decrypted, they re-implemented the entire DRM stack and decryption process: https://github.com/librespot-org/librespot/blob/dev/audio/src/decrypt.rs https://github.com/librespot-org/librespot/blob/dev/audio/sr... You could add a print statement in there to dump keys.
- tbrockman 6y agoI mean "already decrypted" to say that the work of decrypting has already been done for you, sorry if that wasn't clear.
- deleted 6y ago[deleted]
- skykooler 6y agoAlthough, librespot (intentionally) provides no mechanism to write decrypted audio to disk.
- krick 6y agoWell, if you're "interested in learning Rust", it's not that hard to add.
- kingosticks 6y agoOne of the audio backends is a pipe output. There's not much left to do to achieve that goal.
- Macha 6y ago
- speedgoose 6y agoDoes Spotify use the same AES key for all songs? Deezer is doing weird stuff in comparison. A friend told me that each song has every third block of 2048 bytes encrypted using blowfish. The key is derived from the hex md5 of the song ID, xor the same hex md5 but with a Ceasar cipher shift of 16, xor a hard-coded secret. The initialization vector is 0,1,2,3,4,5,6,7.
- mimimi31 6y agoDeezer's encryption has been reverse engineered a few years ago and given rise to lots of scripts for ripping music from the platform. Interestingly it's even possible to download and decrypt lossless files like that without having the subscription you'd normally need to access the higher quality audio.
- drannex 6y agoEven more interesting on Deezer - Deezer Has a New Message for App Pirates — ‘We’re Not Going to Stop You’ https://www.digitalmusicnews.com/2020/10/26/deezer-pirate-app-email-warning/ https://www.digitalmusicnews.com/2020/10/26/deezer-pirate-ap...
- jrz53 6y agoLooks like they pretty much care after all: https://fuwafuwa.moe/transparency/git.fuwafuwa.moe/001.2020-11-06.deezer.takedown/001.deezer.txt https://fuwafuwa.moe/transparency/git.fuwafuwa.moe/001.2020-...
- mmm_grayons 6y agoDeezer has to do some sort of enforcement due to Laches doctrine. But it's pretty halfhearted compared to others.
- lucgommans 6y agoGrooveshark's was a beauty as well: xor 0x25 Wrote a blog post about it back in the day, for those wondering how to break (super easy) encryption: https://lgms.nl/blog-1-plain https://lgms.nl/blog-1-plain
- hyperdimension 6y agoIf three tests from youtube-dl got the RIAA angry, I can't imagine this will be up for long. EDIT: didn't notice it was gitlab rather than github. I'm still rather interested.
- stu2b50 6y agoI don't think gitlab* vs github matters. All public sites in the US and allies need to have a mechanism for DMCA removals, or they lose their safe haven status (which allows them to not be legally liable for what their users do with respect to copyright). Losing safe haven status is a death sentence. * by this I mean gitlab's own instance of gitlab. Of course, you can host your own, and then its up to you how you respond.
- martini333 6y agoBut this was "created for educational purposes"
- stu2b50 6y agoDMCAs are a shoot first, talk later kind of deal. Or rather take it down first, file counterclaims, and see if the other party responds, then put it back up they don't.
- salawat 6y agoCounterclaims are an international poison pill though, as by doing so you agree to having the case adjudicated under U.S. jurisdiction. Think twice. Don't let clever legal tricks like were pulled with DMCA catch you out.
- vmception 6y agoJust clone it and move on DMCA take downs don't delete stuff stored client side on your computer, I fail to see what all this discussion is even about If it looks hot, just clone it and forget about it
- ianlevesque 6y agoWho cares at this point? You can buy DRM-free tracks from iTunes and multiple other providers now. It’s not 1999 anymore.
- gitweb 6y agoBig difference between paying for a song or album vs downloading unlimited DRM-free music for a small subscription fee.
- deleted 6y ago[deleted]
- roboyoshi 6y agospotify has exclusive content and I'm especially angry they make certain podcasts exclusive to their platform. itunes and bandcamp are good though when you want drm-free music.
- steve_mcdougall 6y agoheejin stans unite
- ralphc 6y agoAnyone else see the irony of fuck-capitalism using Visual Studio, a paid product, to do this? Unless he stole it, of course.
- crubier 6y agoNo I don’t? Do you see the irony of fuck-capitalism buying food, a paid product, to survive? Or using a computer, a paid product, to code?
- ralphc 6y agoThe irony derives from using a paid product to keep from having to pay for Spotify songs. Plus the whole username thing.
- risho 6y agoyou have to operate within the world that you exist in even if it goes against your idealized vision of the way things should be.
- dleslie 6y agoNot irony, but perhaps hypocrisy. Self-defeating hypocrisy. There _are_ FOSS alternatives to Visual Studio and Windows which can be used without engaging with capitalists. Even simply using non-FOSS is an endorsement of it and helps to perpetuate its dominance; there's a reason why Microsoft competes with free by being free, itself.
- JorgeGT 6y agoIsn't Visual Studio Community free?
- classics2 6y agoNot to mention it has a software license attached to it. Fuck-capitalism but obey my rules plebs.
- mdifrgechd 6y agoI just want to mention that what I like about Spotify is I dont have to bother figuring this kind of thing out, because it provides music I want to listen to at a price that is completely reasonable.
- gabereiser 6y agoBut your money rarely makes it to the artists. Or worse, as an artist they just rip your music off.
- mdifrgechd 6y agoThat seems orthogonal to my point that what spotify achieved, for me at least, was being a better value for money than copyright infringement. It's worth $10 a month to have all the music accessible in one place. The licensing agreements that spotify negotiates are between them and the artists, and if artists are unhappy they can take it up with Spotify. But hopefully artists realize that for recorded performances, there is a sweet spot where the convenience of a subscription has a higher value than trivially accessing pirated recordings.
- gabereiser 6y agoNever the artists, always the labels or distribution company (not always the same). But to your point. Pre-Spotify I think the overall music market sales volumes and profits, offset by piracy and copyright infringement, ended up around the same overall total market value that Spotify based their subscription and payments off of (that and economics of scale). I’ve been a Spotify subscriber for a long time so I get it. I just wish Spotify would do more to support artists, not labels, or help fix the system for indies to self-distribute. It’s obviously way more complicated. I dream of a utopia where a platform exists not for profits sake but for the art’s sake.
- karaterobot 6y agoUnless every AES key you dump with this application somehow sends money to the artist, I'm not sure how this is better for them than Spotify.
- madrox 6y agoAt one of the earliest E3s, the keynote was from the CTO of AOL. I wish I remembered the year or his name or could find some video of the talk, but this was at the height of Napster where it seemed like no one was paying for music. This guy compared music piracy to the prohibition. He said people didn't want to break the law. People just wanted to drink. I haven't looked at piracy the same way since. Fast forward to seeing this, and I realize this doesn't have the same draw as it would have 20 years ago. People can get the music they want at a price they're willing to accept.
- tomrod 6y agoCompletely agree. People rationally evaluate the cost to breaking the law. It's not a perfect economics 201 model, though, as its not like increasing the enforcement and costs fully deter piracy engagement.
- kace91 6y agoThe problem has been solved for the public, but there's still issues for the supply side though. All the non-mainstream music makes I follow since I was a teenager complain that music has never been in a harder place in terms of making money off of it. Apparently their piece of the cake has massively reduced.
- asdfasgasdgasdg 6y agoDo we know if it has actually constrained supply? As far as I can tell there is an effectively limitless amount of new music to listen to in almost any genre you could pick. I just searched for one genre and I found no less than a hundred new albums this year. https://theboot.com/new-music-rundown-country-americana-bluegrass-folk-albums-coming-in-2020/ https://theboot.com/new-music-rundown-country-americana-blue... I think this is not exhaustive because most of the names I spot checked have produced chart topping singles or won industry-wide awards.
- vkou 6y ago> All the non-mainstream music makes I follow since I was a teenager complain that music has never been in a harder place in terms of making money off of it. Apparently their piece of the cake has massively reduced. This should be expected, given that the amount of artists making commercial non-mainstream music has skyrocketed. The pie has gotten bigger, and the non-mainstream share of the pie has gotten bigger, but there's a lot more people fighting over its scraps.
- deleted 6y ago[deleted]
- turtlebits 6y agoFWIW, Tidal and Google Music/Youtube music Apps download unencrypted m4a/flac (or mp3) to mobile devices. (How you retrieve the files is on you). A much easier way of getting songs to offline devices.
- scastillo 6y agodecrypted file is not ogg
- classics2 6y agoSo cringe.
- mattowen_uk 6y agoI'm going to brace for the Karma hit here, but this is piracy pure and simple. Spotify is pay-to-play and the royalties model is designed around that. Artists/Labels get a a very small slice of money from every play. As a Spotify consumer you do not pay for the right to play the track offline - if you did, the Artist/Label would get a bigger slice. If you want to play the tracks offline, just buy the non-DRM MP3 from Amazon or some other place. For people saying the Labels take all the money anyway, there are many independent artists on Spotify who deserve your money if you play their work. Most of us here are hard working professionals in our fields - how would we feel if someone said at the end of each week, "Thanks for what you did, it's really useful, but I've decided to not pay you, but I'm going to keep your output anyway and use it forever." We wouldn't stand for it, and nor should music artists have to.
- nlitened 6y agoThere’s also the reverse notion of that: “Thank you for buying what I made, I hope it’s really useful, but I am going to keep it away from you unless you pay me forever”.
- notimetorelax 6y agoI think you’ve just described SAAS
- chrisan 6y agoThat is not accurate Spotify is a choice on your behalf. You can pay their monthly fee and get access to their entire library for as long as you pay them Or you can buy the mp3s own them forever from apple/amazon/etc. The artists never continue to ask me to pay them. Personally, I find it better to buy the mp3s. I'll use spotify or pandora and put up with the ads when I want to discover or whatever
- Nullabillity 6y ago> As a Spotify consumer you do not pay for the right to play the track offline Yes you do, this is a specifically advertised feature of Spotify Premium. > Most of us here are hard working professionals in our fields - how would we feel if someone said at the end of each week, "Thanks for what you did, it's really useful, but I've decided to not pay you, but I'm going to keep your output anyway and use it forever." We wouldn't stand for it, and nor should music artists have to. When was the last time you paid for software? Were you happy about what you got? Pay-per-use or pay-per-user simply aren't ethical business models for creative works where all significant costs are up front and fixed.
- IndySun 6y agoFrom napster to piratebay to whatever, I consider YouTube to be the biggest bootlegger of anything that can be digitized - of all time, and by a huge margin. And in plain site. And it is free use. Whatever your views on Spotifys model, breaking that model is stealing. On a wider issue, Spotify and its ilk should be paying more to artists, with royalties scaled.
- arendtio 6y agoOT: On a monthly basis I seem to have problems with the Spotify Web Player (slow loading times, max cpu utilization for a few minutes before I can use the player, a not loading page on the first try, etc.). A few days ago, I could not access the player and desperately wanted to listen to music, so I looked around in the Firefox dev-tools and unregistered the ServiceWorker. After that, everything worked just fine and I decided to deactivate ServiceWorkers for the Profile which I use for Spotify via about:config. Every since, I had no trouble anymore. I know writing ServiceWorkers isn't easy, but that is not my point. My point is, that I pay Spotify to deliver music to me in the DRM protected way the music industry demands for (not the consumer). So fixing things gets harder for me with DRM in place. @Spotify: Please fix your broken software development process and deliver on your promises.
- A6gYPfxNas 6y agoso how do we then use the decryption keys in a useful way?
- CozyCat 6y agoMusicians already earn very little. If you want to play music offline, buy a DRM-free copy.