Shannon's Journal Discussion Thread, Vol. 5

[Shannon]

it's the Subliminal Shop logins that we perform in order to purchase or download that still needs the https around. With only http, we're sending plaintext usernames and passwords, which, if sniffed by a middle man (I could describe in more detail, but I'd rather not), might allow that middle man access to download the compromised user's files, redistribute them, and activate the anti-piracy scripting that we've all spent years listening to. That's what I'm concerned about, not billing security.

It is indeed concerning that login details could be stolen and used to download all our purchases. I doubt that would trigger the anti-privacy script but it would be a huge damage to IML (because if someone goes through the trouble of illegally accessing IML accounts, you can be sure all the subs will be on the black market in a matter of hours.) It would be a lot of pain for the affected users as well, who will have to prove that it wasn’t their responsibility.

As I stated above, that is not the case.  If the AP code triggered when you got hacked and the hacker pirated your stuff, it would be about like charging a mugging victim for being an accomplice in a mugging.  It would make no sense.  AP code only triggers if you commit piracy.  It doesn't matter what fancy name you call it to convince yourself it's not piracy, or what lies you tell yourself that it's not "really" causing anyone any issues, etc. The act of piracy will trigger it.  But having your credentials stolen and used by someone else to commit piracy?  Not happening.  YOU did not commit piracy.