{"id":863,"date":"2014-10-24T14:04:01","date_gmt":"2014-10-24T21:04:01","guid":{"rendered":"http:\/\/galencharlton.com\/blog\/?p=863"},"modified":"2014-10-24T14:04:01","modified_gmt":"2014-10-24T21:04:01","slug":"testing-adobe-digital-editions-4-0-1-round-2","status":"publish","type":"post","link":"https:\/\/galencharlton.com\/blog\/2014\/10\/testing-adobe-digital-editions-4-0-1-round-2\/","title":{"rendered":"Testing Adobe Digital Editions 4.0.1, round 2"},"content":{"rendered":"

Yesterday I did some testing<\/a> of version 4.0.1 of Adobe Digital Editions and verified that it is now using HTTPS when sending ebook usage data to Adobe’s server adelogs.adobe.com.<\/p>\n

Of course, because the HTTPS protocol encrypts the datastream to that server, I couldn’t immediately verify that ADE was sending only the information that the privacy statement<\/a> says it is.<\/p>\n

Emphasis is on the word “immediately”. \u00a0If you want to find out what a program is sending via HTTPS to a remote server, there are ways to get in the middle. \u00a0Here’s how I did this for ADE:<\/p>\n

    \n
  1. I edited the hosts file to refer “adelogs.adobe.com” to the address of a server\u00a0under my control.<\/li>\n
  2. I used the CA.pl<\/a> script from openssl to create a certificate authority of my very own, then generated an SSL certificate for “adelogs.adobe.com” signed by that CA.<\/li>\n
  3. I put the certificate for my new certificate authority into the trusted root certificates store on my Windows 7 deskstop.<\/li>\n
  4. I put the certificate in place on my webserver and wrote a couple simple CGI scripts<\/a> to emulate the ADE logging data collector and capture what got sent to them.<\/li>\n<\/ol>\n

    I then started up ADE and flipped through a few pages of an ebook purchased from Kobo. \u00a0Here’s an example of what is now getting sent by ADE (reformatted a bit for readability):<\/p>\n

    \"id\":\"F5hxneFfnj\/dhGfJONiBeibvHOIYliQzmtOVre5yctHeWpZOeOxlu9zMUD6C+ExnlZd136kM9heyYzzPt2wohHgaQRhSan\/hTU+Pbvo7ot9vOHgW5zzGAa0zdMgpboxnhhDVsuRL+osGet6RJqzyaXnaJXo2FoFhRxdE0oAHYbxEX3YjoPTvW0lyD3GcF2X7x8KTlmh+YyY2wX5lozsi2pak15VjBRwl+o1lYQp7Z6nbRha7wsZKjq7v\/ST49fJL\",\r\n\"h\":\"4e79a72e31d24b34f637c1a616a3b128d65e0d26709eb7d3b6a89b99b333c96e\",\r\n\"d\":[  \r\n   {  \r\n      \"d\":\"ikN\/nu8S48WSvsMCQ5oCrK+I6WsYkrddl+zrqUFs4FSOPn+tI60Rg9ZkLbXaNzMoS9t6ACsQMovTwW5F5N8q31usPUo6ps9QPbWFaWFXaKQ6dpzGJGvONh9EyLlOsbJM\"\r\n   },\r\n   {  \r\n      \"d\":\"KR0EGfUmFL+8gBIY9VlFchada3RWYIXZOe+DEhRGTPjEQUm7t3OrEzoR3KXNFux5jQ4mYzLdbfXfh29U4YL6sV4mC3AmpOJumSPJ\/a6x8xA\/2tozkYKNqQNnQ0ndA81yu6oKcOH9pG+LowYJ7oHRHePTEG8crR+4u+Q725nrDW\/MXBVUt4B2rMSOvDimtxBzRcC59G+b3gh7S8PeA9DStE7TF53HWUInhEKf9KcvQ64=\"\r\n   },\r\n   {  \r\n      \"d\":\"4kVzRIC4i79hhyoug\/vh8t9hnpzx5hXY\/6g2w8XHD3Z1RaCXkRemsluATUorVmGS1VDUToDAvwrLzDVegeNmbKIU\/wvuDEeoCpaHe+JOYD8HTPBKnnG2hfJAxaL30ON9saXxPkFQn5adm9HG3\/XDnRWM3NUBLr0q6SR44bcxoYVUS2UWFtg5XmL8e0+CRYNMO2Jr8TDtaQFYZvD0vu9Tvia2D9xfZPmnNke8YRBtrL\/Km\/Gdah0BDGcuNjTkHgFNph3VGGJJy+n2VJruoyprBA0zSX2RMGqMfRAlWBjFvQNWaiIsRfSvjD78V7ofKpzavTdHvUa4+tcAj4YJJOXrZ2hQBLrOLf4lMa3N9AL0lTdpRSKwrLTZAFvGd8aQIxL\/tPvMbTl3kFQiM45LzR1D7g==\"\r\n   },\r\n   {  \r\n      \"d\":\"bSNT1fz4szRs\/qbu0Oj45gaZAiX8K\/\/kcKqHweUEjDbHdwPHQCNhy2oD7QLeFvYzPmcWneAElaCyXw+Lxxerht+reP3oExTkLNwcOQ2vGlBUHAwP5P7Te01UtQ4lY7Pz\"\r\n   }\r\n]<\/pre>\n
    In other words, it’s sending JSON containing… I’m not sure.<\/p>\n
    The values of the various keys in that structure are obviously Base 64-encoded, but when run through a decoder, the result is just binary data, presumably the result of another layer of encryption.<\/p>\n
    Thus, we haven’t actually gotten much further towards verifying that ADE is sending only the data they claim to. \u00a0That packet of data could be describing my progress reading that book purchased from Kobo… or it could be sending something else.<\/p>\n
    That extra layer of encryption might be done as protection against a real man-in-the-middle attack targeted at Adobe’s log server — or it might be obfuscating something else.<\/p>\n
    Either way, the result remains the same: reader privacy is not guaranteed. I\u00a0think<\/em> Adobe is now doing things a bit better than they were when they released ADE 4.0, but I could be wrong.<\/p>\n
    If we as library workers are serious about protection patron privacy, I think we need more than assurances — we need to be able to verify things for ourselves. ADE necessarily remains in the “unverified” column for now.<\/p>\n
    Share this:<\/h3>