Tolrendor DM's Blog

In Part 1 of this article, we looked at the PDF security options that are available natively in the Acrobat PDF format itself. These included the ability to password protect and encrypt a document, as well as control actions that are available, such as copying or printing. Ostensibly, this seemed like a sufficient set of controls to protect the IP of electronically published D&D products. Unfortunately however, it seems there are two quite significant potential issues with the native approach:

• The Adobe encryption is relatively easy to crack, being only 40-bit, and there are plenty of programs out there that can achieve this on normal equipment.
• The Adobe PDF specification does not enforce that a specific PDF viewer implements the security restrictions! This does seem rather lax in current times!

So it looks like a more solid DRM (Digital Rights Management) solution would be needed to persuade publishers like WOTC to get back into the PDF game. There certainly are options out there, but there are often constraints that come with them. Lets look at a list of key potential ‘wants’ for such a system:

• Simple access and technology requirements
• To be able to use PDF files both on-line and off-line.
• To be able to use PDF files on any device – PC, Mac, Phone, iPad etc…
• Ability to print PDFs
• To be able to read PDFs as soon as they are purchased
• To be able to lend a PDF to a friend, like you would a hard-copy book

The above is a feature list from a user’s point of view. I can imagine WOTC might have an expanded list of requirements:

• Able to integrate the DRM system into a ‘branded’ store
• Able to work with 3rd party distributors such as RPGNow.
• Simple administration of licences
• Simple publishing of protected documents
• Ability to provide various publication options e.g. perpetual licence, subscriptions, time expiry etc.

Are there products out there that can support these features? After some research, I decided to review one product against the requirements: Safeguard Enterprise PDF Security from LockLizard. Unlike many products that I looked out, their product did not rely on continuous access to a central server and/or passwords to be maintained for each document (if you remember the vitriol when WOTC moved to an online only Character Builder, I think you know where I’m coming from…). So, lets have a look:

End User Requirements:

The Safeguard product works by encrypting the entire PDF document with AES 256-bit encryption – this is military strength, so there’s not much out there that can break that without super-computer efforts! So how does the user read the document? Well, this is the downside – the user needs to use a specific secure PDF reader, supplied by Lock Lizard, rather than a standard Adobe Acrobat Reader. Its available for Windows and Mac (with some constraints), so straight away this rules out your phone or tablet :(. Still, I reckon most people would take this over no PDFs, at least to start with. As smartphones and tablets start to dominate the end-user computer market, I’m sure the product would catch up.

The upside is that once you have the PDF, and the secure reader, you don’t need to remember a password, or be connected to the Internet, except for the first time you load it. Once only the secure reader will connect to the licensing server, download a machine specific licence file, and from that point on the PDF can be read on that machine forever (unless the publisher has specifically added some expiration controls). It is also possible to ‘transfer’ the licence to another machine, in case the user upgrades, or even to ‘lend’ the PDF to a friend (i.e. the original user would no longer be able to access it). The PDF can also have print and copy controls built into it, but the secure reader can put watermarks or user information in the printout to discourage mass distribution.

Wizards’ Requirements

Pretty much all of the requirements that Wizards might have from their perspective seem to be catered for, although I’m sure there would be some significant integration requirements. Using the LockLizard eCommerce Add-in, most of the functionality could be hidden behind D&D branding, whether on their own website, or via a 3rd party. The product also has features to allow the licences to have various expiry options based on both the document or the user. For example, for a Core Rulebook distributed as a PDF you would expect the document to have a perpetual licence; but for a subscription based PDF (e.g. Dragon Magazine) the licence for the user might expire in a year (renewable of course…), allowing access to documents published in that annual period, but nothing after that.

Of course, this is a theoretical look at the problem based a small amount of research, and clearly there would be many many issues and details to resolve, but the fact that products are definitely out there that could fulfil a significant proportion of the required use cases does lead me to believe the problem is solvable … if Wizards really want to 🙂

I for one, hope they do, and can …

And if not …

I mentioned in Part 1 that WOTC might be looking at other forms of electronic distribution, like eBooks, but that these formats weren’t really suitable for publications with complex layout requirements…

… Well, recently Apple released a software product called iBooks Author, aimed primarily at  producing interactive textbooks. Might it be applicable to RPG products? Lets take a look at this in another column 🙂

In my last RPG Tech Talk column, I talked about some of the hopes that I have for the ‘DnD Next’ generation of technology tools for role-players. One of the items I would like Wizards of the Coast to look seriously at again is the distribution of their core books through an electronic mechanism such as PDFs.

It’s almost 3 years since WOTC pulled the plug on PDF sales, citing piracy as the main reason. They also mentioned at the time that they would be exploring other means of digital distribution, but that hasn’t come to much, other than their novel lines being released for a number of e-reader platforms. This is however a much different case than role-playing product digital distribution, where the need for a controlled layout is required. E-readers in general do not lend themselves to displaying such publications, and in fact there are few wide-spread digital formats other than PDFs for this purpose (Microsoft’s XPS format has a similar role, but despite having been around for several years now, how many people actually know about it…).

In the meantime, all other third-party publishers have continued to make their content available through PDFs, seemingly without any major piracy worries. Pazio, who with their Pathfinder RPG are seemingly now Wizards’ biggest competitor, has clearly continued to embrace the PDF format, and I think they’re benefiting from it. Now I do realise, Wizards, as the 800 pound gorilla in the RPG zoo, are a bigger target for piracy than many other companies, but surely there is a solution out there that works!? I for one would rather they put their tech budget into solving this problem for their customers than sinking it into VTT tools etc that only a fraction of their user base will ever use regularly for gaming!

Another point worth noting is that although Wizards do not sell any of their published books in PDF form, they do produce PDFs of all their DDI content – which actually accounts for a significant proportion of their content. Strange that they do not view this as a priacy risk?? I guess it’s because this content is only distributed digitally, so can’t affect book sales, but it’s still an interesting anomaly.

So, how could WOTC go about giving us what we all want – the ability to carry our tomes of D&D books round in digital form? Some ideas:

Simple stuff …

In most cases when you purchase and download a PDF online (e.g. from RPGNow or its variants), the actual file will be ‘watermarked’ with your  account name, so its obvious who purchased the PDF. Just as obviously, there are simple ways of removing this watermark, unless the file has a password added that prevents this happening.

In the simplest form of piracy protection, Wizards could ensure that all distributors of its PDFs introduce a watermark at point of sale which identifies the document sufficiently to trace the actual purchaser, and to password protect the document so that the watermark cannot be removed by standard tools (this password would not need to be user-specific, as only the distributor would ever need to know it).

This doesn’t stop someone loading the PDF onto a file-sharing site, but it does mean that without taking some effort, it would be like leaving your contact details at the scene of a crime!! However, one flaw with this approach is that you don’t want the watermark to obscure the actual text, so they are typically placed at the page borders; this unfortunately means that someone could use image editing tools to remove the watermark, and recreate the PDF without it – a time-consuming process, and quality would undoubtedly suffer, but this wouldn’t deter a determined pirate…

A Step Up …

The next level of security is to set a password that must be used to open the file, which prevents any illegal copying or imaging editing of the content.

The process might be that when you purchased a PDF from Wizards’ online store, they would require you to log on with your DDI account, and the password for the PDF would be generated using these credentials. Each PDF in circulation would then have a unique password – making the required piracy effort even greater. What, you say – you mean everyone would need a DDI subscription just to purchase a PDF!? Well no, I’m sure that Wizards could have the concept of a free DDI account which was just used as an ‘account’ on their site, and from which you could retrieve password details for your previous purchases if required.

This scheme would preclude purchasing Wizards’ PDFs from any online site other than their own – this may be desirable for WOTC – but if they do want to support third-party distribution, this could be achieved by providing a web-service or similar interface that the distributor could use to pass credentials in and receive the appropriate password in return.

A downside to this idea is means that everytime you want to access a PDF, you need to enter a password. It might also cause platform issues if some PDF readers (e.g. on a smartphone) did not implement the ability to de-crypt secured PDFs. I think many people would take this over not being able to have their D&D books in any digital form however!

The two ideas above are possible using security features that are built directly into the PDF format, so there’s nothing particularly complex or clever here. They do however, rely on the quality of the security, which can always be broken by the application of enough technology and computing power, so you can never completely stop piracy. The real goal is to make it difficult enough that ‘casual piracy’ is deterred’.

Unfortunately, it does seem that perhaps Acrobat PDF security isn’t necessarily as strong as you’d like, so maybe we need to look at some more complex options… which I’ll cover in Part 2…