4 ms·
Does Spotify use the same AES key for all songs? Deezer is doing weird stuff in comparison. A friend told me that each song has every third block of 2048 bytes
by speedgoose 6y ago
Does Spotify use the same AES key for all songs?
Deezer is doing weird stuff in comparison. A friend told me that each song has every third block of 2048 bytes encrypted using blowfish. The key is derived from the hex md5 of the song ID, xor the same hex md5 but with a Ceasar cipher shift of 16, xor a hard-coded secret. The initialization vector is 0,1,2,3,4,5,6,7.
- mimimi31 6y agoDeezer's encryption has been reverse engineered a few years ago and given rise to lots of scripts for ripping music from the platform. Interestingly it's even possible to download and decrypt lossless files like that without having the subscription you'd normally need to access the higher quality audio.
- drannex 6y agoEven more interesting on Deezer - Deezer Has a New Message for App Pirates — ‘We’re Not Going to Stop You’ https://www.digitalmusicnews.com/2020/10/26/deezer-pirate-app-email-warning/ https://www.digitalmusicnews.com/2020/10/26/deezer-pirate-ap...
- jrz53 6y agoLooks like they pretty much care after all: https://fuwafuwa.moe/transparency/git.fuwafuwa.moe/001.2020-11-06.deezer.takedown/001.deezer.txt https://fuwafuwa.moe/transparency/git.fuwafuwa.moe/001.2020-...
- mmm_grayons 6y agoDeezer has to do some sort of enforcement due to Laches doctrine. But it's pretty halfhearted compared to others.
- lucgommans 6y agoGrooveshark's was a beauty as well: xor 0x25 Wrote a blog post about it back in the day, for those wondering how to break (super easy) encryption: https://lgms.nl/blog-1-plain https://lgms.nl/blog-1-plain
- hatsunearu 6y agowhat the fuck
- Etheryte 6y agoA classic example of stacking algorithms in a way that provides no additional benefit whatsoever. In many cases, stacking encryption algorithms actually weakens the resulting security.
- smhmd 6y ago> In many cases, stacking encryption algorithms actually weakens the resulting security. Could you, please, explain how?
- n3k5 6y agoImagine you have a couple of algorithms that scramble a solved Rubik's cube into a configuration that takes at least 20 twists to unscramble [0]. From there, any attempt to make it ‘even more scrambled’ would be pointless — and actually likely make solving the resulting puzzle easier. Now imagine there's a programmer who wants to make the ultimate cube scrambler despite not knowing any of the above. Their brilliant idea is to take the aforementioned algorithms and chain them together. (Result: snafu.) In essence, the moral of the story is that one shouldn't try stacking encryption algorithms without first acquiring a pretty good understanding of how they all work. [0] https://www.popsci.com/science/article/2010-08/gods-number-revealed-20-moves-will-solve-any-rubiks-cube-position/ https://www.popsci.com/science/article/2010-08/gods-number-r...
- soared 6y agoIf I’m following this logic correctly - running a few more algorithms on something before trying to decrypt will make it easier rather than harder to decrypt? Is the ceiling for “max encryption” that low, or is just that one algorithm combined with another has a local maximum?
- n3k5 6y agoI just cherry-picked a simple example to make a clear illustration, but … > running a few more algorithms on something before trying to decrypt will make it easier rather than harder to decrypt? No, it could make it easier, harder, or about the same. The ‘harder’ case is just unlikely when the algorithms one started with were already state-of-the-art and the programmer didn't know what they were doing. It might seem tempting to think that a cryptanalyst now has to do twice the work, but what they're really doing isn't cracking multiple encryptions — they're just attacking a different encryption.
- bootloop 6y agoIt's a single key per song.