Steve
I'm a PC, so shut up
Consultant
join:2001-03-10
Yorba Linda, CA
| reply to justin
Re: MVP Summit: Friday notes
said by justin  :Does the rights management stuff encrypt the XLS,PPT,DOC files etc Rights Management itself doesn't know anything about file formats, it only knows about content streams - it's up to the application to deal with the file formats and save the crypted content how it likes.
My understanding is that it's put back in the XLS,PPT,DOC format, but since it's crypted nobody else will be able to do anything with it whether it's OpenOffice or Notepad.
One of the questions I asked was what stops me from writing my own app that "looks like" Word but doesn't enforce any of the restrictions (allowing me to save in cleartext, etc.). The answer is "a contract".
In order to get a certificate required to sign a manifest identifying an application, one has to promise not to do things like this.
It never occurred to me to ask about open-source type integrations (which would have been a killer good question), but since they use SOAP, it seems like it's probably possible to figure out how to make this kind of request via sniffing and/or reverse engineering.
Off the top of my head - and I have to be clear that I don't know anything about this beyond what I learned this morning - the certificate would be a sticking point. There's just now way any app could get an "I'm MS Word" cert because it would be a trivial tool for subversion of rights. But I dunno.
I've posted a question to our presenter and will report what I hear.
Steve
--
Stephen J. Friedl • Unix Wizard • Microsoft Security MVP • Tustin, California USA • my web site |
