🚀 go-pugleaf

On Mon, 25 Mar 2013 22:19:53 -0400, David Lamb <dal...@cs.queensu.ca>
wrote:

>On 25/03/2013 6:40 PM, Rin Stowleigh wrote:
>> On Mon, 25 Mar 2013 22:01:56 GMT, john...@frontier.com (John Lewis)
>> wrote:
>>> On Mon, 25 Mar 2013 01:06:38 -0400, Rin Stowleigh
>>> <rstow...@gmail.com> wrote:
>>>> Simple authentication and not DRM.
>>> Simple authentication used to mean a CD-Key, locking the game to its
>>> purchased CD or DVD.
>>
>> No, you're just confusing matters.  That is a form of copy protection,
>> not authentication.  Please research these things before discussing,
>> because a mistake like this so early in the post nulllifies pretty
>> much everything that follows it.
>
>When I first read your post, Rin, I thought, yeah, copy protection and 
>authentication are different things, and then I started wondering 
>whether the difference makes any difference and which one CD keys really 
>were. Do you have technical definitions of both terms that would make it 
>clear that the difference matters?
>
>It has been many moons since I used a CD-key game so I have forgotten 
>most details. If I recall correctly you'd install the game, but it 
>wouldn't work until you typed in the CD key; the installed game only 
>enabled itself for use if it decided the long string of characters was a 
>valid key. What was it that prevented someone from using the same key on 
>different machines? Online registration? CD key had to match something 
>in the data burned into the CD itself and CD had to be in the drive? 
>something else? If you required online registration of a CD key, then 
>surely that was authentication. If not -- what was it that prevented 
>somebody from using the same key on different machines?

Lately, definitions seem to be a can of worms around here.  We could
analyze what the word "authorize" means (outside of
technical/computing terminology).  Then we could go down the road of
"well here's what it means to _________" (fill in the blank with any
one person, group of people in a given industry, etc.

I think what matters for purpose of this thread is the context I was
using for the term when I talked about Steam using authorization
rather than DRM, because that was the meaning that John was attempting
to counterargue.

That context was the generally accepted meaning in computing, which is
basically "verifying a user is who they say they are".  That does not
mean necessarily that the user has given a real name or true
identifying information, it just means that if I have registered with
a service under the name John Doe, then that service authorizes me
when I log on using some unique password that proves I am John Doe
(even if I'm not really John Doe).  The term is usually used to
identify the "credential identification" portion of a login sequence
or other type of check, and to differentiate it from "authorization"
(the two terms are often confused or used incorrectly).

In other words, authentication is "Who's there?  Lets see some ID.."
and authorization is "Ok John Doe, we've confirmed you're who you say
you are, here's what you have access to based on your permission set".

When you enter a serial key into an application to "unlock it",
"activate it" (i.e. allow the player to play it), that process is
really authorization (and usually called serial key authorization),
because it is not about identifying a users credentials or logging
them into to a session for some entity (although admittedly it could
be combined with that, as it is for some Steam games with serial
keys), because it is basically authorizing that computer (not person)
to play the game.

I believe Steam is a somewhat pure example of authentication, because
it's really all about identifying the account holder.  The company
that sells/produces the games sold on Steam are who decides how it is
authorized, whether DRM is involved, etc.  Steam is just verifying you
are who you say you are (arguably you could still be anonymous
although that typically changes the moment you give them a credit
card, a somewhat "more accurate" form of authentication).  A game
company can release a completely free to play game on Steam; in that
case, anyone can play from any account and any PC, thus there is
really no authorization in that case.  A company can also sell a game
that is restricted to one paid copy per account (Steam has handled the
authentication, but the seller of the game is handling authorization).
They could also go one step further and add DRM, which can do things
like restrict how many PC's total the app can be installed on.  

Some folks think Steam itself *is* the DRM mechanism but it's not. Can
it be utilized if the game publisher chooses to help enforce DRM?
Surely, but by itself Steam only authenticates.