No Passwords or Logins
No passwords or login information for users to enter, forget or share, or for you to manage and distribute.
Keys to decrypt ebooks are transparently and securely transferred to authorized devices and locked to them.
When it comes to protecting your ebooks from piracy or theft, ebook DRM (e-book Digital Rights Management) is probably one of the first things you will think of.
Digital rights management is the only effective security to stop ebook copying and unauthorized distribution, but most systems are poorly implemented.
Many publishing platforms (Amazon Kindle Ebooks, Google Play Books, and Kobo) rely on the protection supported by Adobe Digital Editions (ebook reader software that uses Adobe Content Server for protection) but that has significant flaws. The main one being that the ebook protection can be easily removed.
Here we discuss the most popular ebook formats, ebook DRM protected content, is DRM is best for ebooks or are their better alternatives, and which DRM for ebooks is best.
If a security system uses weak protection then it is simple for users to unlock DRM protected ebooks.
Ebook Digital Rights Management (DRM for short) refers to a series of controls that, at their most basic level, are used to prevent the unauthorized copying, editing, and sharing of content. More advanced DRM solutions additionally lock use to devices, prevent screen grabbing, allow publishers to revoke use after a certain date, and more.
We cover how does DRM work in our overview of Digital Rights Management – this applies equally to ebooks. However, ebook DRM works differently for installed apps and browser-based solutions:
As we’ll cover below, however, the poor implementation of most DRM solutions has led to them becoming trivial to remove.
Kindle readers support five different file formats: MOBI, KFX, AZW, EPUB and PDF. The MOBI, AZW and KFX formats use Amazon’s DRM, whereas EPUB and PDF ebooks are protected by DRM using Adobe ADEPT / Adobe Content Server. Google Play uses Adobe DRM.
However, all these DRM protection schemes are really easy to remove:
So, you may wonder: what protection are your ebooks actually getting against piracy and theft if the security can be easily removed?
If you trust users not to use ebook DRM removal tools, then you might equally trust them not to share your ebooks with others and therefore have no need to implement DRM security to begin with.
Read DRM for Kindle ebooks and How to protect ebooks from sharing and copying to see how easy it is to remove popular ebook DRM formats.
An alternative to using the above platforms for ebook distribution and protection is using software to generate an HTML5 ebook that can be viewed in the browser.
However, protecting ebooks in a browser is limited. There is no software installed on the client computer to decrypt the content or provide significant control over it once it has been decrypted. Protected content either has to be decrypted on the server and relayed to the client (some bad implementations decrypt straight to disk where it is left available in the cache in plain text) or by using JavaScript in the browser. JavaScript is also used to enforce restrictions such as preventing copy, edit, print and download.
As we have shown in How secure are Google Docs and Flip books, it is simple for users to bypass the protection.
“We have been looking for years to find a software company that would allow us to securely sell our eBooks. Locklizard offers so many options, we are able to fill the needs of all of our customers. We have used other software providers that had promised the security of our eBooks but they never lived up to that promise the way that Locklizard has.
The support we received has been outstanding. They are very responsive to our requests and go the extra mile.
I would recommend Locklizard if you are looking for secure ebooks.”
There are many ebook DRM remover tools that work with MOBI, KFX, AZW, EPUB and PDF files. The most popular are:
You might ask why these ebook DRM removal applications are so successful. It’s simple: the above DRM security has been implemented as an afterthought (and usually rather badly), enabling applications to either plugin to (to access the content as it is decrypted or intercept the decryption keys) or pickup unprotected content that the system has directly cached to disk. This is nothing new – Elcomsoft pointed out the issues with Adobe PDF DRM and other ebook protection methods back in 2000. 20 years on and removing the DRM from ebooks is still trivial. See PDF Security issues for weak DRM implementations and Adobe PDF encryption for how simple it is to unlock or break the security.
Adobe’s standard security handler uses RC4 stream cipher, encrypting file content with a unique encryption key. The encryption key is encrypted and stored in the file’s encryption dictionary. Either the user password or owner password can recover the encryption key and decrypt the file content. Removing PDF Passwords covers this subject in more detail.
In 2009 Adobe Digital Editions was broken by i♥cabbages allowing users to remove the DRM protection from Adobe ebooks. They commented “There is very little obfuscation in how Adobe Digital Editions hides and encrypts the per-user RSA key, allowing fairly simple duplication of exactly the same process Digital Editions uses to retrieve it”. 5 years later, in 2014, Adobe released Adobe Content Server 5 which, in their own words, is “A more secure Digital Rights Management scheme to protect EPUB and PDFs from unauthorized viewing. The new hardened DRM solution uses multiple encryption layers with Adobe Licensing server having the control to change the mechanism of encrypted key generation.” And later generations promised better protection. Today however, ebook DRM removal software can still remove Adobe Digital Editions, proving that it does not matter how many layers of encryption you have if it is implemented poorly.
Publishers who implemented later editions were also in for a shock. Customers reported losing e-books from their libraries after having upgraded to the latest version. Sadly, access being denied to PDF documents and ebooks after an Adobe update is not new. Companies that have implemented the Acrobat PDF DRM plugin have also had furious customers unable to access DRM protected PDF files since every time Acrobat is updated the plugin no longer works.
PDF is still the most common format for document distribution since it produces reliable results across all platforms. Adobe PDF DRM, however, is flawed and can be removed easily (just like Adobe PDF password protection and permissions or restrictions).
If you are serious about protecting PDF ebooks from piracy and theft, and are happy to provide your own means of distribution (rather than using an ebook publishing platform), then using DRM that does not rely on Adobe (or a third party DRM plugin to Acrobat) or the browser, is clearly the way forward.
Adobe DRM might be the industry standard but any solution that can be instantly removed is not worth implementing to begin with. And that is before you even consider the costs involved:
Some companies say that DRM that completely secures content must be cumbersome or difficult to use and that their solution strikes the perfect balance between ease of use and security.
Let’s be clear, if the security can be easily removed it is not effective and you are wasting your money. An ebook DRM or PDF DRM system can be secure yet easy to use.
Locklizard ebook DRM protects PDF files using AES 256 bit encryption and DRM controls to ensure your ebooks are protected against simple DRM removal applications. Our DRM protects ebooks in PDF format from piracy, copying and sharing.
We prevent printing to PDF, block screen grabbers from taking screenshots, and lock ebooks to devices so they cannot be shared. If you don’t want users to install a Viewer, then you can distribute your secure ebooks on a USB stick that includes the Viewer software. Users can then open DRM protected files directly from USB without installing any software. You can publish whole ebook libraries on USB sticks and then later grant access to individual books. You can also add new ebooks as you publish them and you can grant access accordingly.
Locklizard ebook DRM enables you to sell ebooks securely without insecure passwords, JavaScript, or plug-ins, and enforce access, location, expiry, and usage controls. Our DRM technology ensures your ebooks remain safe regardless of their location with US Gov Strength encryption, licensing, and DRM controls. Ebook content is decrypted in memory and no temporary files are used.
Many companies claim to protect ebooks from sharing and advertise them as alternatives to ebook DRM or as DRM solutions. Are they effective or is DRM best for ebooks?
Here we cover the most common ways you can protect ebooks and their weaknesses:
You protect a PDF ebook with a password and apply limited restrictions over content use. Passwords have to be manually entered so they can be shared with others (and therefore your ebooks) or just simply removed, and PDF restrictions can be instantly removed.
For each user who purchases your ebook, you provide a unique, single use link that may or may not expire. These stop multiple users from downloading ebooks using the same link but do not stop users sharing ebooks with others once they have downloaded them.
File encryption software enables you to encrypt any type of file. It is great for protecting ebooks on servers or in transit, but once a user has decrypted the file, they can share it with others.
Any solution that enables users to view ebooks in the browser provides weak security despite how secure it says it is. Not only can users share login details, they can also bypass restrictions that prevent copy, print, edit and download. We cover this in How secure are Google Docs. All browser viewers use the same system (JavaScript) for enforcing restrictions and have the same security weaknesses regardless of their ‘DRM protection’.
Various online solutions allow you to upload PDFs to their website for conversion into a HTML5 flipbook or PDF flip book, which introduces page flip transitions and security controls to prevent download, copying, printing, etc. Unfortunately, like all browser-based controls these are easy to bypass. Changing a single line of code usually lets users download unprotected copies of the flipbook in PDF format.
If your ebook is not protected with DRM then watermarks can be easily removed. PDF watermarks can be removed in a PDF editor in a single action and a hidden watermark can be removed by either saving them as different file formats or printing to PDF.
Only DRM can be used to restrict how content is used – not encryption, password protection or onetime links. DRM can stop ebook sharing, content copying and editing, disable printing, enforce watermarks and tracking, and control expiry.
So, DRM is best for ebooks, but not all ebook DRM is equal. Some solutions provide limited restrictions or weak security, and have been comprehensively cracked. It’s important to choose your ebook format and software solution carefully.