Brit says sorry after waving around nonce patent and leaning on sites to cough up
(2021/08/26)
- Reference: 1629976987
- News link: https://www.theregister.co.uk/2021/08/26/datawing_csp_patent_claims/
- Source link:
The director of a tiny UK company has apologised after sending letters to businesses suggesting they had infringed his patents that he claimed covered an age-old web standard.
The tech in question is the content security policy ( [1]CSP ) mechanism that websites use to protect their visitors from cross-site scripting (XSS) attacks and similar exploits that steal data and hijack accounts. Specifically, the cryptographic [2]nonce feature of CSP to stop unauthorized scripts from running.
Datawing Ltd sent a number of letters to small businesses this month claiming to own one UK and one US patent on CSP and its use of a nonce. After an initial wave of alarm and outrage on Twitter when the letters surfaced, The Register tracked down their author: a penitent William Coppock.
[3]
When asked if he was chancing his arm by sending the letters, Coppock immediately said: "Probably, I don't know. I hope people don't see me as a patent troll."
[4]
[5]
Public attention was first drawn to Datawing's letters by internet hacker Scott Helme, who told El Reg : "It's a bit worrying if turning on a security feature provided by the web browser can get you into trouble."
Coppock's letter to the businesses read:
I am writing to you because you are the proprietor of a website making use of a Content Security Policy Level 2.0 (CSP 2.0) feature, known as the "nonce", which prevents the unauthorised execution of JavaScript in web browsers.
It has come to our attention that this important security feature is an embodiment of an invention devised by myself in 2011, more than two years prior to the publication of the CSP 2.0 standard.
The letter claimed "our patent has been widely overlooked by companies since the inception of CSP 2.0 in 2014," advertised Datawing's Scriptlock product which "augments CSP 2.0 with new features which greatly reduce the cost of adding CSP support to existing websites," and suggested that if companies weren't interested in Scriptlock, they should "obtain a licence to work the patent."
"Technical information is enclosed with instructions for how to register with us and license fees," it concluded.
What's a CSP nonce?
CSP works by limiting what resources a browser can load when it fetches a page. "With a few exceptions, policies mostly involve specifying server origins and script endpoints," Mozilla explained in a [6]developer document about CSP.
Microsoft [7]said the CSP nonce is "a cryptographically strong random value generated on each page load that appears in both the CSP policy and in the script tags in the page. Using nonces can help to minimize maintaining a list of allowed source URL values, while also allowing trusted script declared in script elements to run."
Can you say prior art?
A website administrator for one of the companies Coppock targeted, and who asked not to be named, told The Register : "The recipients are very concerned. Additionally we as the web developers, being security conscious, were trying to implement good security standards for our customers."
Others spoke to Helme, who [8]documented his own investigation into the affair and asked questions on Twitter about Datawing's claims. Some of the replies were quite instructive.
[9]
For instance, this [10]tweet linked to software engineer Gervase Markham's idea of [11]script keys , designed – like CSP – to thwart XSS attacks.
[12]Australian court rules an AI can be considered an inventor on patent filings
[13]Cloudflare offers $100,000 for prior art to nuke networking patents a troll has accused it of ripping off
[14]Third time's a harm? Microsoft tries to get twice-rejected compression patent past skeptical examiners
[15]Wells Fargo patent troll case has finance world all aquiver so Barclays, TD Bank sign up to Open Invention Network
Markham, who worked for Firefox-maker Mozilla and died in 2019, also described a randomisation feature to ensure his mechanism couldn't be easily bypassed by malicious scripts: in other words, a cryptographic nonce as used in CSP 2.0.
His 2005-era blog post therefore describes the essential features of Coppock's UK patent [16]2,496,107 , which was filed in 2011 and granted in 2013. Coppock was granted its US counterpart, [17]8,959,628 , in 2015. In his paperwork, the nonce is described as a password.
'Not sure I can be bothered'
Coppock told El Reg he was "not sure if I can be bothered" to try to enforce his decade-old patent. He accepted that CSP has been baked into the main two browser engines for years and did not suggest, when asked, that he had made any serious effort to enforce the patent against anyone until his most recent batch of 25 letters sent to companies whose websites had CSP 2.0 nonces enabled.
"What a stupid plonker, all I've done," he sighed, adding that he has six children and has been diagnosed with cancer. Applying for the UK and US patents cost him his "life savings," he said, adding: "I didn't intend any harm to come to anyone. Maybe I've just got to sell or give this thing to Mozilla."
Whether Coppock's motivation was to draw attention to what he described as his "homebrew talent" or to make money out of companies that paid up rather than challenge his claims, he denied to The Register that he was a patent troll. A law firm had checked over the letter and the "patent infringement outline" document before he sent them, he claimed.
Coppock also apologised to all who received his letters and urged them to contact him if they had any questions about it.
[18]
We have asked the law firm Coppock named for comment on the advice he says it gave him and will update this article if we hear back from it.
The company director also confirmed he was aware of the [19]Intellectual Property (Unjustified Threats) Act 2017 , which makes it a civil offence to send unjustifiable threats of patent lawsuits. While the Datawing letters did not explicitly threaten legal action if companies ignored them, and so do not appear to fall within section 1 of the act, some people were so worried by them they sought legal advice.
Patent trolling is the practice of a non-trading entity buying up patents and then trying to enforce them through the courts to guarantee a revenue stream. The practice hobbles legitimate value-creating businesses to the point that [20]global networks were formed to fight against patent trolling. Not, we think, that an English court would have entertained Coppock's patent assertions for very long. ®
Get our [21]Tech Resources
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
[2] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#attr-nonce
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
[7] https://blogs.windows.com/msedgedev/2017/01/10/edge-csp-2/
[8] https://scotthelme.co.uk/i-turned-on-csp-and-all-i-got-was-this-crappy-lawsuit/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://twitter.com/sirdarckcat/status/1429834510129061909
[11] https://blog.gerv.net/2005/03/script_keys/
[12] https://www.theregister.com/2021/08/02/ai_inventor_allowed_in_australia/
[13] https://www.theregister.com/2021/04/26/cloudflare_patent_troll/
[14] https://www.theregister.com/2021/03/13/microsoft_ans_patent/
[15] https://www.theregister.com/2021/02/15/barclays_td_bank_join_oin/
[16] https://www.ipo.gov.uk/p-ipsum/Case/PublicationNumber/GB2496107
[17] https://patents.google.com/patent/US8959628B2/
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://www.legislation.gov.uk/ukpga/2017/14/contents
[20] https://www.theregister.com/2021/02/15/barclays_td_bank_join_oin/
[21] https://whitepapers.theregister.com/
The tech in question is the content security policy ( [1]CSP ) mechanism that websites use to protect their visitors from cross-site scripting (XSS) attacks and similar exploits that steal data and hijack accounts. Specifically, the cryptographic [2]nonce feature of CSP to stop unauthorized scripts from running.
Datawing Ltd sent a number of letters to small businesses this month claiming to own one UK and one US patent on CSP and its use of a nonce. After an initial wave of alarm and outrage on Twitter when the letters surfaced, The Register tracked down their author: a penitent William Coppock.
[3]
When asked if he was chancing his arm by sending the letters, Coppock immediately said: "Probably, I don't know. I hope people don't see me as a patent troll."
[4]
[5]
Public attention was first drawn to Datawing's letters by internet hacker Scott Helme, who told El Reg : "It's a bit worrying if turning on a security feature provided by the web browser can get you into trouble."
Coppock's letter to the businesses read:
I am writing to you because you are the proprietor of a website making use of a Content Security Policy Level 2.0 (CSP 2.0) feature, known as the "nonce", which prevents the unauthorised execution of JavaScript in web browsers.
It has come to our attention that this important security feature is an embodiment of an invention devised by myself in 2011, more than two years prior to the publication of the CSP 2.0 standard.
The letter claimed "our patent has been widely overlooked by companies since the inception of CSP 2.0 in 2014," advertised Datawing's Scriptlock product which "augments CSP 2.0 with new features which greatly reduce the cost of adding CSP support to existing websites," and suggested that if companies weren't interested in Scriptlock, they should "obtain a licence to work the patent."
"Technical information is enclosed with instructions for how to register with us and license fees," it concluded.
What's a CSP nonce?
CSP works by limiting what resources a browser can load when it fetches a page. "With a few exceptions, policies mostly involve specifying server origins and script endpoints," Mozilla explained in a [6]developer document about CSP.
Microsoft [7]said the CSP nonce is "a cryptographically strong random value generated on each page load that appears in both the CSP policy and in the script tags in the page. Using nonces can help to minimize maintaining a list of allowed source URL values, while also allowing trusted script declared in script elements to run."
Can you say prior art?
A website administrator for one of the companies Coppock targeted, and who asked not to be named, told The Register : "The recipients are very concerned. Additionally we as the web developers, being security conscious, were trying to implement good security standards for our customers."
Others spoke to Helme, who [8]documented his own investigation into the affair and asked questions on Twitter about Datawing's claims. Some of the replies were quite instructive.
[9]
For instance, this [10]tweet linked to software engineer Gervase Markham's idea of [11]script keys , designed – like CSP – to thwart XSS attacks.
[12]Australian court rules an AI can be considered an inventor on patent filings
[13]Cloudflare offers $100,000 for prior art to nuke networking patents a troll has accused it of ripping off
[14]Third time's a harm? Microsoft tries to get twice-rejected compression patent past skeptical examiners
[15]Wells Fargo patent troll case has finance world all aquiver so Barclays, TD Bank sign up to Open Invention Network
Markham, who worked for Firefox-maker Mozilla and died in 2019, also described a randomisation feature to ensure his mechanism couldn't be easily bypassed by malicious scripts: in other words, a cryptographic nonce as used in CSP 2.0.
His 2005-era blog post therefore describes the essential features of Coppock's UK patent [16]2,496,107 , which was filed in 2011 and granted in 2013. Coppock was granted its US counterpart, [17]8,959,628 , in 2015. In his paperwork, the nonce is described as a password.
'Not sure I can be bothered'
Coppock told El Reg he was "not sure if I can be bothered" to try to enforce his decade-old patent. He accepted that CSP has been baked into the main two browser engines for years and did not suggest, when asked, that he had made any serious effort to enforce the patent against anyone until his most recent batch of 25 letters sent to companies whose websites had CSP 2.0 nonces enabled.
"What a stupid plonker, all I've done," he sighed, adding that he has six children and has been diagnosed with cancer. Applying for the UK and US patents cost him his "life savings," he said, adding: "I didn't intend any harm to come to anyone. Maybe I've just got to sell or give this thing to Mozilla."
Whether Coppock's motivation was to draw attention to what he described as his "homebrew talent" or to make money out of companies that paid up rather than challenge his claims, he denied to The Register that he was a patent troll. A law firm had checked over the letter and the "patent infringement outline" document before he sent them, he claimed.
Coppock also apologised to all who received his letters and urged them to contact him if they had any questions about it.
[18]
We have asked the law firm Coppock named for comment on the advice he says it gave him and will update this article if we hear back from it.
The company director also confirmed he was aware of the [19]Intellectual Property (Unjustified Threats) Act 2017 , which makes it a civil offence to send unjustifiable threats of patent lawsuits. While the Datawing letters did not explicitly threaten legal action if companies ignored them, and so do not appear to fall within section 1 of the act, some people were so worried by them they sought legal advice.
Patent trolling is the practice of a non-trading entity buying up patents and then trying to enforce them through the courts to guarantee a revenue stream. The practice hobbles legitimate value-creating businesses to the point that [20]global networks were formed to fight against patent trolling. Not, we think, that an English court would have entertained Coppock's patent assertions for very long. ®
Get our [21]Tech Resources
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
[2] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#attr-nonce
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
[7] https://blogs.windows.com/msedgedev/2017/01/10/edge-csp-2/
[8] https://scotthelme.co.uk/i-turned-on-csp-and-all-i-got-was-this-crappy-lawsuit/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://twitter.com/sirdarckcat/status/1429834510129061909
[11] https://blog.gerv.net/2005/03/script_keys/
[12] https://www.theregister.com/2021/08/02/ai_inventor_allowed_in_australia/
[13] https://www.theregister.com/2021/04/26/cloudflare_patent_troll/
[14] https://www.theregister.com/2021/03/13/microsoft_ans_patent/
[15] https://www.theregister.com/2021/02/15/barclays_td_bank_join_oin/
[16] https://www.ipo.gov.uk/p-ipsum/Case/PublicationNumber/GB2496107
[17] https://patents.google.com/patent/US8959628B2/
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YSe6u6NPwYYeeG8pI@PXkwAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://www.legislation.gov.uk/ukpga/2017/14/contents
[20] https://www.theregister.com/2021/02/15/barclays_td_bank_join_oin/
[21] https://whitepapers.theregister.com/
Nonces
Arthur the cat
Whichever way you take the word, they've been around since long before 2011.
RIP Gerv.
John Robson
That's all.
Allonymous Coward
I didn’t know Gervase Markham had died. Sad to hear that.
Sorry to hear this other bloke apparently has cancer too, attempted patent troll or no.
Sometimes life feels too short to worry about boring things like computers or patent law.
"chancing his arm"
Gene Cash
Awright, I learn something new every day from El Reg...
Obligatory Animal House quote
The Man Who Fell To Earth
"So, if you mention extortion again, I'll have your legs broken." - Mayor Carmine DePasto (Animal House, 1978)
Well done, Mr Plonker!
DJV
So, he was granted a patent on something that already had prior art. Then it looks like what appears to be a devious law firm (and I sometimes wonder if there's any law firm out there that has never done anything devious) has said he can gain monetary benefits by sending out letters that are just short of threatening. Well, he's right about one thing - he's definitely a plonker though that realisation is probably only due to the current backlash!
Potemkine!
law firm
The best thing law firms are able to do is to issue bills to their customers. For the rest, the quality of service is more random
Best?
MNB
Issuing invoices is not the best thing that law firms do... It is merely the thing that they do best.
I'll get my coat on the way out, it's the one with the pedant's hat in the pocket.
The law is clear
Anonymous Coward
He was first to file, and receive, the patent. End of discussion. Just because someting becomes a standard doesn't mean we can let the law be ridden over roughshod
As I see it, the browser and toolkit providers have no option but to license (or buy for a body like the Open Innovation Network) these patents.
Or do we consider all tehcnology patents like exFAT suddenly null and void?
What the entrenched power are upset at is that it's a smaller operator doing the patent shakedown for a change and not them. Tough tits. Pay up.
Eh?
Mr Dogshit
nonce
in British English
NOUN
derogatory, prison slang
a rapist or child molester; a sexual offender
Worst Patent Troll. Ever.
Zippy´s Sausage Factory
Still, at least that's the British way - try, mess it up, and then apologise profusely. Tea, anyone?
Hubert Cumberdale
And there's me thinking that a "cryptographic nonce" was just someone trying to avoid revealing the full contents of his hard drive.
Well, at least in this case, it was actually his patent, and not one bought in.
HOWEVER, yet another patent on something obvious. If years back, someone came to me and asked for a way to stop these types of attacks, this would have been my solution. It would also have been the same solution from 99% of the readers here.