🚀 go-pugleaf

On Mon, 25 Mar 2013 23:42:47 -0400, Rin Stowleigh
<rstow...@gmail.com> wrote:

>On Mon, 25 Mar 2013 22:19:53 -0400, David Lamb <dal...@cs.queensu.ca>
>wrote:
>
>>On 25/03/2013 6:40 PM, Rin Stowleigh wrote:
>>> On Mon, 25 Mar 2013 22:01:56 GMT, john...@frontier.com (John Lewis)
>>> wrote:
>>>> On Mon, 25 Mar 2013 01:06:38 -0400, Rin Stowleigh
>>>> <rstow...@gmail.com> wrote:
>>>>> Simple authentication and not DRM.
>>>> Simple authentication used to mean a CD-Key, locking the game to its
>>>> purchased CD or DVD.
>>>
>>> No, you're just confusing matters.  That is a form of copy protection,
>>> not authentication.  Please research these things before discussing,
>>> because a mistake like this so early in the post nulllifies pretty
>>> much everything that follows it.
>>
>>When I first read your post, Rin, I thought, yeah, copy protection and 
>>authentication are different things, and then I started wondering 
>>whether the difference makes any difference and which one CD keys really 
>>were. Do you have technical definitions of both terms that would make it 
>>clear that the difference matters?
>>
>>It has been many moons since I used a CD-key game so I have forgotten 
>>most details. If I recall correctly you'd install the game, but it 
>>wouldn't work until you typed in the CD key; the installed game only 
>>enabled itself for use if it decided the long string of characters was a 
>>valid key. What was it that prevented someone from using the same key on 
>>different machines? Online registration? CD key had to match something 
>>in the data burned into the CD itself and CD had to be in the drive? 
>>something else? If you required online registration of a CD key, then 
>>surely that was authentication. If not -- what was it that prevented 
>>somebody from using the same key on different machines?
>
>Lately, definitions seem to be a can of worms around here.  We could
>analyze what the word "authorize" means (outside of
>technical/computing terminology).  Then we could go down the road of
>"well here's what it means to _________" (fill in the blank with any
>one person, group of people in a given industry, etc.
>
>I think what matters for purpose of this thread is the context I was
>using for the term when I talked about Steam using *authentication*
>rather than DRM, because that was the meaning that John was attempting
>to counterargue.
>
>That context was the generally accepted meaning in computing, which is
>basically "verifying a user is who they say they are".  That does not
>mean necessarily that the user has given a real name or true
>identifying information, it just means that if I have registered with
>a service under the name John Doe, then that service  *authenticates* me
>when I log on using some unique password that proves I am John Doe
>(even if I'm not really John Doe).  The term is usually used to
>identify the "credential identification" portion of a login sequence
>or other type of check, and to differentiate it from "authorization"
>(the two terms are often confused or used incorrectly).
>
>In other words, authentication is "Who's there?  Lets see some ID.."
>and authorization is "Ok John Doe, we've confirmed you're who you say
>you are, here's what you have access to based on your permission set".
>
>When you enter a serial key into an application to "unlock it",
>"activate it" (i.e. allow the player to play it), that process is
>really authorization (and usually called serial key authorization),
>because it is not about identifying a users credentials or logging
>them into to a session for some entity (although admittedly it could
>be combined with that, as it is for some Steam games with serial
>keys), because it is basically authorizing that computer (not person)
>to play the game.
>
>I believe Steam is a somewhat pure example of authentication, because
>it's really all about identifying the account holder.  The company
>that sells/produces the games sold on Steam are who decides how it is
>authorized, whether DRM is involved, etc.  Steam is just verifying you
>are who you say you are (arguably you could still be anonymous
>although that typically changes the moment you give them a credit
>card, a somewhat "more accurate" form of authentication).  A game
>company can release a completely free to play game on Steam; in that
>case, anyone can play from any account and any PC, thus there is
>really no authorization in that case.  A company can also sell a game
>that is restricted to one paid copy per account (Steam has handled the
>authentication, but the seller of the game is handling authorization).
>They could also go one step further and add DRM, which can do things
>like restrict how many PC's total the app can be installed on.  
>
>Some folks think Steam itself *is* the DRM mechanism but it's not. Can
>it be utilized if the game publisher chooses to help enforce DRM?
>Surely, but by itself Steam only authenticates.

Wow, it's been a long day, and I just did a great job of confusing
matters further by saying authorization when I meant authentication.
Great example of why they so often get mixed up :)

I've gone through and corrected the above in the places where I
screwed it up (look for the word in asterisks above).