Thread 2 on encryption on Phase Shift.

[captainoffun22]

Hi, I know I posted this before but I really think Phase Shift should have a encryption system, some people want it and some people hate it, but still at least add it and people can still release songs without the encryption but for the people who want there master tracks safe, then it would be good, maybe you make a file like NoWayToTheCity.pse, I know that .pse is for photo shop but yeah, it could mean Phase Shift Encryption, I do have some ideas so David or knapman [FD], you can contact me by message and I will give you some ideas on how this can work, thanks.

[David]

Right now we have no compelling reason to encrypt songs. The Phase Shift and FOF community have worked hard and for free and I feel this will go against that for very little gains. Phase Shift is where it is today because of artist allowing us full access to their songs and we want to support that.

Thanks
David

[captainoffun22]

Mar 28, 2015 6:21:38 GMT David said:

Right now we have no compelling reason to encrypt songs. The Phase Shift and FOF community have worked hard and for free and I feel this will go against that for very little gains. Phase Shift is where it is today because of artist allowing us full access to their songs and we want to support that.

Thanks
David

OK, it just that some people want to encrypt there songs on the Frets On Fire forums, thank you for replying.

[knapman [FD]]

This topic is pointless, its already been answered multiple times, the PC is an open platform, I don't believe effective offline encryption is something we can do even if we wanted to, we could waste months stripping down the game and locking things out to make it a little tricky at best, so at the end of it we get a massively compromised game, with a flawed protection system.

Any time spent on that would be better spent just making games, not obsessing over the unachievable task of protecting them.

The reality is even if the encryption itself was good, you don't specifically need to beat encryption head on to get at what you want, on an open platform you have a lot of options available with screwing with the game itself to sidestep the encryption completely.

If the system only works for a certain time period what does it do other than trick artists into a false sense of security.


Imagine some of the crap we could go through to try achieve this.

We'd probably need to lock the game down to stand a chance of detecting unwanted tampering, so we'd want to remove anything that complicates detection. So no modding, game runs in vanilla form, anything that doesn't pass validation would simply stop the game working.

The music studio functionality would have to go, and any other gameplay options that might allow easy stem isolation. Volume control options should be capped at a minimum level that is always audible needed or not.

Then consider some bonus side effects, performance would take a hit, longer load times and higher memory usage while the game does all its extra checks and handles decryption. False positives could also lead to increased instability and random crashing.



We could go a step further and consider what would really be required to actually do this in a way that might hold up, so it isn't a complete waste of time

Really the solution is the game just needs to be a stripped down local client and move everything to the server.

You'd need to have an account to play and be online at all times. All songs would be streamed from the server, player run servers wouldn't be supported as we can't hand out the encryption system. The game wouldn't support playing local files at all so no customs either.

Attempts at hacking would result in an account ban as fear is key to discouraging casual attempts at getting at the audio, and obviously if you lose connection mid game the game just freezes until connection restored, if it times out it boots you back to the login screen.

Being a smaller indie project we couldn't have servers all over the world so loading could take a while if you aren't near a local server, and if too many people are playing you could get stuck in a queue to play your next song. If you have a slow connection then your going to have trouble in general. We'd need to keep file size as low as possible so audio quality would be reduced.

To maintain this infrastructure this model couldn't be free. As the market has shifted to a point where always online games struggle with upfront fees and subscription models the game would likely need to be full of micro-transations and adverts.


Or the other option, just make your game console only so you can pass the blame to MS / Sony if needed....

[captainoffun22]

So I wonder how GHPCED got Envision? Because Danny does not want the stems to go to anyone so they have a encryption system but you don't have to go all that crazy with the volume stuff, with Rock Band you could just get a full band or go into practice mode and record and set the volume low om everything else, but if Phase Shift ever wanted to get a RBN band like A Day to Remember, then they would not want to have there songs in the game if they did not know it was safe, like for Rock Band custom they got Hidden Secret Song from Anarchy Club, the song was going to go onto RBN, but now it got a custom and that band has been in Rock Band from day 1, and it is multitracked, do you think the band would of let them add the stems if Rock Band did not have a encryption system, they might of let them only have the song not with stems, and now C3 with the Phase Shift converts, they no longer come with stems as Phase Shift does not have a encryption system, 1 day I got The Rhyme for Phase Shift as It was a band that said yes for Rock Band Customs, the Phase Shift one came with stems, but few days later I downloaded it again and it came with no stems just the song, and for people that want it to be real, when they miss notes they will always still hear the guitar.

[raynebc]

Guitar Hero would have used a commercial level encryption scheme, and that's the kind of thing music labels want if they're worried about protecting the audio. Even if Phase Shift added encryption I don't expect it would do much to sway nervous rights holders. There must be so many things on Phase Shift's wish list that would provide more benefit.

[captainoffun22]

Apr 1, 2015 5:52:57 GMT raynebc said:

Guitar Hero would have used a commercial level encryption scheme, and that's the kind of thing music labels want if they're worried about protecting the audio. Even if Phase Shift added encryption I don't expect it would do much to sway nervous rights holders. There must be so many things on Phase Shift's wish list that would provide more benefit.

OK, I will just forget about it, also have you seen my thread about EOF?

[raynebc]

If it's the post about Guitar Hero import, I've replied to it.

[knapman [FD]]

Apr 1, 2015 5:01:51 GMT captainoffun22 said:

a RBN band like A Day to Remember, then they would not want to have there songs in the game if they did not know it was safe,

Well its not going to be safe, that was the point, and im not aware of anything we can realistically do that will change that. If we could, that would be great, but as mentioned before most forms of drm are just time delays and the only ones really proven to hold up are server based. These are not suitable options for us.

Lets say we ignore all of that and just do it anyway, and we get a bunch of additional songs with the agreement we are keeping the audio "safe" with our encryption. When things go wrong, what comes next. Maybe some people shrug and go oh well, but what happens when one artist / label decide their business has taken damage from this leak and want to take legal action, as we failed to keep their property safe. Are we in a position to handle that. The answer is obviously no, a situation like that would be the end of the project.

The situation for GH / RB is very different, there isn't much point in making comparisons, Activision is an industry giant and has the means to handle these kind of issues, and they benefit from the extra security buffer of being on locked down platforms, potentially if an exploit come through the system itself then the blame could fall with ms / sony anyway.

Harmonix, being a smaller company need to minimise risk as much as possible, security is likely to be one of the key reasons we have never seen attempts to bring rock band to pc, its just avoiding a lot of potential complications.

Even guitar hero having activision behind it, the PC side of that franchise was a mess, the access to the majority of songs effectively was restricted, we didn't get most of the sequels and they removed the song store from the PC version. The development of world tour itself seemed to have a lot set backs, It felt like there were a lot of behind the scenes issues with getting this game onto shelves for PC. I wouldn't be surprised if its all related to the same topic.

[TrojanNemo]

I'm one of the people posting on the FoF forums who is for Phase Shift adding encryption support.
I'm posting here because I've been asked, but as I said there, I don't expect or hope to sway you (the devs) to change your plans. I'm just going to make a statement as to why some of us want it and how it can be implemented.

You mention how the Phase Shift community has worked for free all this time, and somehow suggest that adding support for encryption goes against that. It does not. Quite the contrary, it encourages some to support Phase Shift more openly.
I don't speak on behalf of C3, but I will speak as to why C3 earlier this year dropped support for multitracked Phase Shift songs, since it was my suggestion and implementation.
C3 exists to create custom songs for Rock Band. Since early on, C3 offered support for Phase Shift players. I have created a tool that automates converting a Rock Band song to Phase Shift format. This includes separating the Rock Band mogg into its component ogg files for Phase Shift use. Every single song (1000+ at this point) offered by C3 for Rock Band, is also offered for Phase Shift.
C3 is NOT in the business of providing multitracks for DJs, audio remixers, and more importantly, to people looking to grab multitrack files and then trade or sell them online. The multitracks that C3 has provided are either purchased at the expense of the author, or in the case of some provided by myself and Orange Harrison, created after hours of effort with audio engineering software. Since the multitracks are only and exclusively offered for the benefit of playing the GAME, all C3 songs are encrypted using audio encryption supported by Rock Band. This applies to Xbox, Wii and PS3 versions of the songs offered by C3. For a good while, C3 thought the benefit to Phase Shift players outweighed the negatives of providing decrypted oggs, and so while C3 encrypted all other versions of the songs, Phase Shift versions had to go unencrypted and were obviously the weak link as far as protecting C3 multitracks.
Then it became evident that people saw C3 as a way to get multitracks for uses other than playing the games, and C3's encryption was strengthened and the Phase Shift versions of the songs lost multitrack support. At this point, all C3 songs for Phase Shift have been downmixed to a single ogg for this reason.

Another very prolific player and supporter of Phase Shift is bluzer. He single handedly has converted enough songs from both Guitar Hero and Rock Band franchises to keep anyone happy for years. I don't speak on his behalf, but from my conversations with him, he has recently began to experience a similar situation to C3. People are taking the multitrack audio he provides expressly for use with Phase Shift, and have begun uploading them to LiteRecords.com and similar audio trading/selling websites. As a result, bluzer has begun combining some of the audio tracks, and if it continues, we might see the end of bluzer's conversions for Phase Shift using multitracks.

So you have at least two providers of Phase Shift content that would benefit from added support for encryption. On the other hand, encryption can and should be optional. Those that don't want it, don't suffer from it being added.

I take issue with some of the claims made as to how it would have to be implemented. Look at how Rock Band did it - they don't stream the songs from a server. Each song file has both decryption keys embedded. It's in how they're obfuscated that they've managed to defeat attempts at cracking their encryption to date, with the known exception being xorloser's work with RB1 and RB2. Would it take some effort? Yes. Would it take you months? Shouldn't. Do you have to strip down the entire game code? Absolutely not.

Lastly, the one argument that you (and your supporters on the thread on FoF) have is that it would, indeed, be easier to crack virtually any encryption on a PC when compared to cracking that same encryption on a console. However, the people C3 and bluzer would be interested in stopping aren't the hardcore crackers who can debug the game using IDA Pro and grab the decrypted file or decryption routine from memory. That is the 0.1%, if even that much, of people who even come across our files. Those are not the shady types looking for easy multitracks to trade for credits online. So if you can add encryption support that would defeat 99.9% of attempts to get at the audio, I would say that is worth the effort in my opinion.

As I said above, I don't expect to sway you. It's pretty clear you feel strongly. But since arguments are being made, and I was asked to make mine on here, there it is.

[David]

In general if the encryption can be broken then a tool will at some point be created allowing anyone including the "shady types" access to them. Phase Shift isn't going to last forever and I'd hate for any new projects to be held back by bad decisions we've made. We've had to deal with poor rips and standards from FOF for years and we have finally after a long battle broken free from most of them. This kind of thing is a step in the wrong direction for the rhythm game community.

Thanks
David

[knapman [FD]]

I don't view the idea of encryption as a bad thing, but its just not the win button some people seem to make it out to be, it won't stop the issues, the 99.9% figure simply isn't true when methods / tools may only be a google search away that require no barrier to entry, again on console you can't just execute code or interface with the system easily but the PC makes it easy for even casual users.

Even then its the so called 0.1% that are the problem anyway, its not the 99% causing the problems. The people who profit from it will be the ones putting the most effort into getting what they want. So what is the encryption doing again, blocking all the people who were harmless and doing nothing to stop the ones we actually wanted to stop?

[TrojanNemo]

Apr 1, 2015 16:58:53 GMT knapman [FD] said:

So what is the encryption doing again, blocking all the people who were harmless and doing nothing to stop the ones we actually wanted to stop?

Again, encryption doesn't hurt anyone. The "harmless" people want to play the game. If the game supports encryption, then there is no harm. If those "harmless" people want to use the audio for anything other than the game, then they are no longer "harmless" in my eyes.

And I disagree with your assessment that the 0.1% are the ones to worry about. I am not worried about them. Because I am part of that 0.1% myself. And just like I know enough to encrypt and obfuscate C3 files, and obfuscate the source code and decryption routines to make it harder for those trying to reverse it, I also know enough to reverse it myself. I know that people like me can get at C3 files just like they can get at Rock Band and Guitar Hero files, in a variety of ways, no matter what I do to try and stop them. I'm not worried about that 0.1% because they can't be stopped and worrying about them would lead to the same inaction we have going on now with Phase Shift - "it will eventually be beat, so let's not even try for now."

But once C3 began encrypting their files and C3 was no longer a source for easy to grab multitracks, those leechers stopped joining the C3 forums and stopped posting about getting at the audio files. The encrypting of C3 files has succeeded in what C3 wanted, which is to make those looking for easy multitracks think twice about trying to get at C3's files. Will it be decrypted at some point? I have no doubt. Can people get at C3 stems like they do with Rock Band stems using analog inline recording? Sure. But so far it lets me sleep better at night, and will continue to do so for a while. The time I spent in implementing it was worth it for me.

I get it that this is not a compelling argument for you, since you'd be doing the work with no benefit to you.
Still, the internet is a nice place to exchange ideas, no?

[knapman [FD]]

Well it hurts in the way that we already have features in the game that undermine encryption in the first place, removal of functionality would be unavoidable, to people who use that functionality it is certainly harmful, adding to the insult the reasons for removal are for a feature that will likely mean nothing long term

Along with the fact time spent reworking the game, removing / adding features comes directly at the expense of working on other features, we are very stretched for time these days so long term value of any major feature we would work on is an important factor

I don't disagree with the issues, solving the underlying issues would be quite an achievement, smaller artists already have a hard enough time as it is and we wouldn't want to be part of something that adds to the problem, if hiding stems is helping the artists then thats a good move even if it takes away from our project. But as I've said, I don't believe the suggested route is a viable solution, and as I can't really see a point where we'd even have the time to put that to the test, even if we wanted to, its not really the most interesting topic if we are just speculating about the benefits

If someone wants to make a real case for it, fof is open source, show us the way

[raynebc]

That's a pretty fair point, do any open source rhythm games support encryption? If open source can keep assets secure, then a closed source one should be able to do the same. For the sake of argument, if Phase Shift did happen to add encryption, but it got broken after C3 began releasing encrypted stems for it, would it stop offering the encrypted stems?