4 ms·

For films and the like it might be easy to get around this - the release teams could sign their releases. It might be theoretically difficult for them to get th

For films and the like it might be easy to get around this - the release teams could sign their releases. It might be theoretically difficult for them to get their public keys out into the ecosystem, but it would be pretty easy in practical terms. For arbitrary data you could possibly have a rating/tagging system. I guess the content industries could fudge the votes, but if the votes were tied to identity/pseudonyms they'd have to be clever to beat any kind of data analysis. The effectiveness would probably depend on how many garbage alternatives you provided, and how sophisticated/varied their uploading is. Too many bad files and voting and signing might not be practicable, and you'd have to resort to some kind of automated spam-detection. White-listed sources are workable in the worst case, but I'm sure there would be other, better ideas around.

gcr 14y ago
Signing pirated media? Would the release teams really want to give the RIAA the ability to cryptographically prove that they were the ones who released the material?
- sneak 14y ago
  Last I checked, nobody's requiring government-issued ID for generating RSA keys.
  - dolbz 14y ago
    No but if you're caught with a hard drive full of pirated material AND the encryption keys for those releases then you're gonna have a hard time in court. The keys need not be government issued to prove you're responsible.
    - sneak 14y ago
      How exactly are they to prove that nobody else has those keys? I think you're overthinking it.
      - TeMPOraL 14y ago
        But the whole idea is for them and only them to have those keys; otherwise the system is worthless.
pedrolll 14y ago
Wht do you mean by signing? Scene groups don't use torrents.
- repsilat 14y ago
  Scene groups provide nfo files with their releases. Those nfo files could contain a cryptographic signature proving the authenticity of the rip. Essentially, the way it works is that for a given group there are two keys: A private key `P` (that only the group has), and a public key `Q` (that everyone has). For a file `F` the "signature" is the output of some function `sign(P, Q, F)`. The function `sign` is specially chosen so that the output can be validated without access to `P`, but cannot be efficiently forged without it. As other posters have pointed out, this means that if `P` is kept secret then all signed releases can be authoritatively linked to the people who provided them. Finding `P` on someone's thumb drive is a smoking gun. To be honest, I don't think this would be a big worry, but I'm not in the scene and I don't know how the people in it think.
  - Strom 14y ago
    Classic scene groups are not interested in having their releases spreading on torrent sites, so including any signatures would be helping with what they don't want to happen in the first place. That said, a third party could add a signature. But in practice a cryptographically secure signature isn't even needed. It boils down to a reputation system, so that you can associate a torrent file with quality and this has already existed since forever on sites like the piratebay in the form of uploader usernames. A lot of torrents are uploaded by the same users, users who have a history of quality torrents. In contrast, a hollywood uploader would never have any actual quality torrents in the account history. So in conclusion, this problem was already solved ages ago.
  - JonnieCache 14y ago
    The warez group CORE sign their releases with CRCs in their NFO files. They distribute a checker program called core10k.exe which ironically often turns up with malware injected into it on p2p sites.

gcr 14y ago

Signing pirated media? Would the release teams really want to give the RIAA the ability to cryptographically prove that they were the ones who released the material?

sneak 14y ago
Last I checked, nobody's requiring government-issued ID for generating RSA keys.
- dolbz 14y ago
  No but if you're caught with a hard drive full of pirated material AND the encryption keys for those releases then you're gonna have a hard time in court. The keys need not be government issued to prove you're responsible.
  - sneak 14y ago
    How exactly are they to prove that nobody else has those keys? I think you're overthinking it.
    - TeMPOraL 14y ago
      But the whole idea is for them and only them to have those keys; otherwise the system is worthless.

pedrolll 14y ago

Wht do you mean by signing? Scene groups don't use torrents.

repsilat 14y ago
Scene groups provide nfo files with their releases. Those nfo files could contain a cryptographic signature proving the authenticity of the rip. Essentially, the way it works is that for a given group there are two keys: A private key `P` (that only the group has), and a public key `Q` (that everyone has). For a file `F` the "signature" is the output of some function `sign(P, Q, F)`. The function `sign` is specially chosen so that the output can be validated without access to `P`, but cannot be efficiently forged without it. As other posters have pointed out, this means that if `P` is kept secret then all signed releases can be authoritatively linked to the people who provided them. Finding `P` on someone's thumb drive is a smoking gun. To be honest, I don't think this would be a big worry, but I'm not in the scene and I don't know how the people in it think.
- Strom 14y ago
  Classic scene groups are not interested in having their releases spreading on torrent sites, so including any signatures would be helping with what they don't want to happen in the first place. That said, a third party could add a signature. But in practice a cryptographically secure signature isn't even needed. It boils down to a reputation system, so that you can associate a torrent file with quality and this has already existed since forever on sites like the piratebay in the form of uploader usernames. A lot of torrents are uploaded by the same users, users who have a history of quality torrents. In contrast, a hollywood uploader would never have any actual quality torrents in the account history. So in conclusion, this problem was already solved ages ago.
- JonnieCache 14y ago
  The warez group CORE sign their releases with CRCs in their NFO files. They distribute a checker program called core10k.exe which ironically often turns up with malware injected into it on p2p sites.