https://shkspr.mobi/blog/2022/05/liberating-out-of-copyright-photos-from-smartframes-drm/ Terence Eden's Blog Liberating out-of-copyright photos from SmartFrame's DRM * By @edent on 2022-05-15 * copyright drm * 3 comments * 750 words * Read ~2,313 times. --------------------------------------------------------------------- During the middle of the 20th Century, the UK's Royal Air Force took thousands of photographs of the country from above. Think of it like a primitive Google Earth. Those photographs are "Crown Copyright". For photographs created before 1st June 1957, the copyright expires after 50 years. Recently, the organisation "Historic England" started sharing high-resolution copies of these photos on a nifty interactive map. Aerial Photo Explorer You can explore over 400,000 digitised photos taken from our aerial photo collections of over 6 million photographs preserved in the Historic England Archive. Use our nationally important collections of aerial photographs to explore your area. Find the place where you live or why not look for your favourite football ground, railway station or the places you visit? But there were two problems. Firstly, they claimed that the photographs were still under copyright. This (no doubt inadvertent) mistake was pointed out to them and was eventually corrected. It seems that, without announcement, @HistoricEngland have dropped the claim that copyright-expired pre-June 1957 RAF images are still in copyright, from their Aerial Photo Explorer pic.twitter.com/uceK7qzQxd -- Andy Mabbett (@pigsonthewing) April 2, 2022 The second, and to my mind more troubling, problem is that the photos were "protected" using SmartFrame's Digital Restrictions Management. SmartFrame has some useful features - it allows for high-resolution photos to be loaded "zoomed out" in lower resolution. The user can then zoom in on a portion which then gets loaded as higher resolution. That's it really. SmartFrame's main selling point is that it "brings robust image control". AKA, it uses DRM to prevent users from downloading images. It also promises "Complete image protection". This is nonsense. If you transmit an image to a user, the user can copy that image. Here's how easy it is to download the images which SmartFrame claims to protect. Screenshots The obvious flaw in SmartFrame is that users can take screenshots of the high-resolution image. Zoom in, screenshot, pan left, another screenshot, repeat. Of course, stitching together all those images is a bit of a pain. But perfectly possible to automate if you wanted to. Canvas Chunks The way SmartFrame works is by loading small "chunks" of the image and then drawing then on a element. In your browser's network inspector, you'll see each 256x256 sub-image loading. Screenshot of a network inspection panel. Dozens of JPEG images are being downloaded. The images are not encrypted, so they can be saved directly. Again, it is a manual and tedious process to scrape them all and then stitch them together. Inspecting the network requests shows that they all use the same Accept Header of authorization/wndeym9ajvin,*/* - that appears to be common across multiple SmartFrame instances. Bad form of them to reuse that key! Canvas Access It's fairly easy to download anything drawn onto a element by running: var c = document.getElementsByClassName("stage") c[0].toDataURL() However, SmartFrame have overloaded the .toDataURL() function - so it produces a warning when you try that. It's simple enough to disable their JS once the image has loaded. Of course, the is smaller than the full resolution image - so you may need to manually increase its size first. It's also possible to simply right-click on the in the inspector and copy the Base64 representation of the image: Screenshot of the context menu showing a download option. Putting it all together I am indebted to Stuart Langridge for connecting all the dots. He has written and fully documented some code which is, essentially: 1. Grab the canvas 2. Resize it 3. Wait several seconds for the image chunks to fully load onto the canvas 4. Turn the canvas into a Data URL 5. Download the data It looks something like this: var container = document.querySelector("div.articlePage.container"); container.style.width="6000px"; container.style.maxWidth="6000px"; setTimeout(()=>{ var stage = document.querySelector("canvas.stage"); var url = document.createElement("canvas").toDataURL.call(stage); var a = document.createElement("a"); a.href = url; a.download = "liberated.png"; a.click(); }, 3000); And that's it. A user can paste a dozen lines of Javascript into their browser's console and get a full-resolution PNG. Warnings This technique should only be used to download images which are free of copyright restrictions. Companies should be careful before buying a DRM solution and ensure that it is fit for purpose. SmartFrame really isn't suitable as sold. Despite its grandiose claims of "Super-strong encryption" and "Multi-layered theft-prevention" - it took less than weekend to bypass. It is possible that SmartFrame will update their systems to defeat this particular flaw. But, thankfully, DRM can never work effectively. You can't give users a locked box and a key - then expect them to only unlock the box under the "right" circumstances. As Bruce Schneier once said: trying to make digital files uncopyable is like trying to make water not wet. --------------------------------------------------------------------- Share the love: * Twitter * Facebook * LinkedIn * Reddit * HackerNews * Lobsters * Email * Pocket * WhatsApp * Telegram * Like this: Like Loading... More posts from around the site: 3 thoughts on "Liberating out-of-copyright photos from SmartFrame's DRM" 1. 2022-05-15 12:37 [S9xtAqyu] [twitter] Tracy King says: This is a great workaround. It's a tricky one because the work and cost of digitising and hosting/preserving the original photos plus hosting and maintaining the scans is not zero, but that in no way is reflected in the price they were trying to charge. Reply 2. 2022-05-15 14:42 [efd2489a] Andy Mabbett says: Thank you for your input on this work, and for this write-up; and to Stuart Langridge and others in the linked discussions for their insights. A few additional points: There are apparently just over 38K such images (taken by the RAF before 1st June 1957, so out of copyright) on Historic England's "Aerial Photo Explorer" site Historic England have refused to supply me with high-resolution copies of these images in response to my FoI request - https:// www.whatdotheyknow.com/request/raf_images_on_aerial_photograph - because they are "reasonably accessible" to me; in other words, by me buying them at a cost of PS12 plus VAT - EACH. Over half a million quid for all of them! How denying the public easy access to and free reuse of these out-of-copyright images meets Historic England's purpose to " [help] people care for, enjoy and celebrate England's spectacular historic environment" is not clear. Other organisations also use SmartFrame to prevent members of the public from downloading images of out-of-copyright artworks. Tate ("Our mission is to increase the public's enjoyment and understanding of British art...", for example While copyright in more recent works should of course be respected, there are legitimate exceptions - https://www.gov.uk/ guidance/exceptions-to-copyright - to UK copyright law (such as study, review or parody, etc), where copyright images may legally be downloaded and used (usual "I am not a lawyer" caveat applies). Downloading images whose copyright has expired is not "theft" Reply 3. 2022-05-15 21:20 [xJmeN3mr] [twitter] Emma needs [?][?] says: I do enjoy a bit of hacking in the browser's inspector, esp. when it's undoing someone else's copyright land grab. shkspr.mobi/blog/2022/05/l... #tw #linkblog Reply Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment *[ ] Name * [ ] Email * [ ] Website [ ] [ ] Notify me of follow-up comments by email. [ ] Notify me of new posts by email. [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] To respond on your own website, enter the URL of your response which should contain a link to this post's permalink URL. Your response will then appear (possibly after moderation) on this page. Want to update or remove your response? Update or delete your post and re-enter your post's URL again. (Learn More) [ ] [Ping me!] Enjoyed this post? Claim your FREE email subscription Enter your email address to subscribe to this blog and receive brand new posts by email. (Or subscribe to this RSSAtom Feed.) Join 13,302 other subscribers. Email Address [ ] Free Sign Up Search Blog Posts Search for: [ ] [Search] Explore The Archives 2022 January 30 posts February 23 posts March 15 posts April 19 posts May 9 posts June July August September October November December 2021 January 31 posts February 28 posts March 31 posts April 30 posts May 31 posts June 30 posts July 31 posts August 31 posts September 30 posts October 31 posts November 30 posts December 31 posts 2020 January 31 posts February 29 posts March 31 posts April 30 posts May 31 posts June 30 posts July 31 posts August 31 posts September 30 posts October 31 posts November 30 posts December 31 posts 2019 January 31 posts February 12 posts March 17 posts April 12 posts May 12 posts June 10 posts July 7 posts August 5 posts September 6 posts October 14 posts November 30 posts December 17 posts 2018 January 8 posts February 4 posts March 6 posts April 14 posts May 5 posts June 6 posts July 6 posts August 13 posts September 14 posts October 8 posts November 30 posts December 4 posts 2017 January 12 posts February 9 posts March 8 posts April 4 posts May 10 posts June 5 posts July 5 posts August 6 posts September 3 posts October 4 posts November 30 posts December 2016 January 10 posts February 10 posts March 11 posts April 9 posts May 8 posts June 9 posts July 6 posts August 9 posts September 4 posts October 2 posts November 30 posts December 14 posts 2015 January 8 posts February 11 posts March 10 posts April 4 posts May 9 posts June 3 posts July 7 posts August 9 posts September 10 posts October 2 posts November 30 posts December 4 posts 2014 January 13 posts February 13 posts March 14 posts April 14 posts May 8 posts June 7 posts July 9 posts August 5 posts September 5 posts October 1 post November 30 posts December 20 posts 2013 January 25 posts February 17 posts March 15 posts April 18 posts May 11 posts June 14 posts July 6 posts August 14 posts September 6 posts October 4 posts November 30 posts December 14 posts 2012 January 14 posts February 8 posts March 13 posts April 15 posts May 10 posts June 16 posts July 8 posts August 8 posts September 6 posts October 6 posts November 30 posts December 31 posts 2011 January 13 posts February 11 posts March 11 posts April 12 posts May 8 posts June 8 posts July 6 posts August 5 posts September 11 posts October 7 posts November 30 posts December 17 posts 2010 January 6 posts February 15 posts March 12 posts April 13 posts May 4 posts June 3 posts July 15 posts August 8 posts September 11 posts October 9 posts November 30 posts December 9 posts 2009 January 1 post February 5 posts March 3 posts April 7 posts May 12 posts June 8 posts July 10 posts August 10 posts September 12 posts October 22 posts November 31 posts December 15 posts 2008 January 2 posts February March 2 posts April 3 posts May 2 posts June July 1 post August 3 posts September 1 post October 3 posts November 2 posts December 1 post 2007 January February March April May June July August September October November 4 posts December 5 posts 2006 January February March April 1 post May June July August September October November 1 post December 2005 January February March 1 post April May June July August September 1 post October November December 2004 January February March April May 5 posts June 3 posts July 1 post August September October November December 2003 January February March 2 posts April May June July August September October November December 2002 January February 1 post March April 3 posts May June July August September October November December 2001 January February March April May June July 1 post August September October 1 post November December 2000 January February March 1 post April May June July August September October November 1 post December 1999 January February March April May June July August September 1 post October November December 1 post 1997 January 1 post February March April May June July August September October November December 1995 January February March 1 post April May June July August September October November December 1987 January February March April May June July August September October November December 1 post * (c) Terence Eden * Contact Me * Subscribe * Citations * Support My Blog * About Me ISSN 2753-1570 Send to Email Address [ ] Your Name [ ]Your Email Address [ ] [ ] loading [Send Email] Cancel Post was not sent - check your email addresses! Email check failed, please try again Sorry, your blog cannot share posts by email. %d bloggers like this: