Inkyu Oh
← All work

Security

Social DRM

Can a book stay readable in every app and still name the copy that leaked? A proof of concept for selling ebooks without locking the reader shut.

Year
2022
Role
Solo — concept, PDF pipeline, forensic recovery
Status
Proof of concept — never pitched
Eleven pages, eleven marks. The page finds its own empty space — 5,606 usable slots on this one — and the copy takes a different set every time.

The problem

I wanted to buy an ebook and read it wherever I liked. Hard DRM does not allow that: the file is bound to one reader app, it breaks when you change device, and the person it inconveniences most is the one who paid. Publishers keep it anyway, because the alternative on offer is nothing at all.

Social DRM is the middle path the industry already knows works — Tor Books dropped DRM entirely in 2012 without the collapse everyone predicted, and O'Reilly and Pottermore have sold watermarked, unlocked files for years. Instead of locking the file, you mark it, so a leak can be traced to the copy it came from. The file itself stays an ordinary PDF that any reader can open.

So the technical problem was not the hard part. The hard part was that publishers are sensitive about anything with DRM in its name, and 'trust me, it works' is not an argument. What was missing was evidence. This project is that evidence: a marking scheme, an attack bench that tries to destroy it, and a live demo that traces a leaked screenshot back to the order in front of you.

How it changed

Each version below exists because the one before it was wrong about something specific.

  1. v1

    The visible layers

    Why
    The first two layers are the ones the buyer is supposed to see: an ex-libris line in the footer and a notice on the contents page. Their whole job is deterrence — social DRM works by the buyer knowing the copy is theirs, not by stopping anything.
    Change
    Stamp the copy with a human-readable ownership line and a plain-language notice about what the marking is for.
    Result
    Fine against a whole file put on a torrent, and useless against the thing that actually happens — someone screenshots two pages and drops them in a group chat. A crop carries no footer. The deterrent worked; the proof did not survive.
  2. v2

    Marks that survive a cropped screenshot

    Why
    To prove a leak from a fragment, the mark has to be everywhere the fragment might be cut from, and invisible enough that a paid book still looks like a paid book.
    Change
    Find every patch of true whitespace on the page with a summed-area table — thousands per page, each an O(1) query — then let the copy's own token seed which patches it uses. A QR is drawn into the chosen slots as vector rectangles at 85% grey, so 'delete every image in the PDF' does not reach them. Recovery runs a decode ladder: raw, then contrast-stretched, then upscaled.
    Result
    Compression, rescaling and rotation are free — QR was built for that. Cropping is the only attack that matters, and density is the whole defence: at one mark per page a cropped screenshot is traced about 22% of the time, at twenty-four marks it is 100%. Since a leak is rarely one page, one mark still resolves ten leaked pages 92% of the time.
    A page of the Attention Is All You Need paper with every candidate blank slot outlined in blue, densely packed through the margins and gaps between paragraphs
    Every slot a mark could occupy on one page. Whitespace on a typeset page is mostly margin — which is also this scheme's blind spot.

The mark means nothing without the service

Anyone can scan the QR with a phone, so the mark must be worthless on its own. It carries an 80-bit HMAC of an internal order reference and nothing else — no name, no email, no order id. Scan it and you get sixteen characters of noise.

Only the issuer resolves it. The service re-derives each customer's token from the signing secret and matches: drop a cropped screenshot into the demo and it comes back Traced — DT3PFW6435CQ3BZS → order-4471. The buyer's identity never travels inside the document, which is what makes this legal to ship under GDPR and 개인정보보호법, and it is why commercial products like LemonInk mask the email they print.

There is a fallback below even that. Because placement is seeded by the token, the layout is unique per copy and recomputable by the issuer — so if every symbol is degraded past decoding, three smudges at reproducible coordinates still narrow the registry down.

I never got the meeting. The deck was for publishers and the conversation did not happen, so this stayed a proof of concept with two honest gaps: a crop containing only body text carries no mark at all, and two buyers who diff their copies can find every mark. Both are written into the README and one is pinned by a test, so the claims cannot quietly rot.

What did survive is the work itself. Everything I learned here about reading PDF structure — page geometry, text extraction, where a document keeps its empty space — became Label, which is the same file format asked a friendlier question.

The demo's result panel: token DT3PFW6435CQ3BZS, symbol 1-L, 11 marks across 11 pages, and below it a drop zone reporting Traced — DT3PFW6435CQ3BZS to order-4471
The whole claim in one panel. A screenshot goes in; the order comes back.
Settings panel: order reference never stored in the document, marks per page set to 1 with its recovery rate shown inline, lightness 55%, playback speed
The trade-off is a slider, not a claim. Each density shows its own recovery rate, so a publisher can pick a threat model instead of taking my word for one.

Built with

  • Python
  • HMAC-SHA256
  • QR
  • PyMuPDF
  • zxing-cpp
  • NumPy
  • FastAPI