Security alert: Tidal music tracks can be downloaded for free straight from the server

It is now possible to download tracks from the online music streaming service Tidal for free to keep permanently on your PC by using TiDown, a new software designed by a teenaged coder. Spotify has long argued that it is making a tangible difference in the fight against online piracy, because it uses a business model whereby a wide selection of music is made available to users for free as long as they have an internet connection and are willing to listen to some adverts.

And if users don't want to listen to adverts, they can choose to pay a monthly subscription fee to either stream or download tracks to their devices, which can be listened offline but only within the music service's app.

These business models work out cheaper than requiring consumers to pay for each track they download, as iTunes and Google Play do, and have been adopted by Spotify's rivals Tidal, Deezer and Apple Music.

In order to combat online piracy, if the consumer is using the online music streaming service, the music is never stored on the user's computer, but is instead streamed as packets of data from the companies' servers. And if the consumer chooses to use the Offline mode, then the tracks are downloaded and encrypted so that the files can only be opened if the music service app authenticates that the user has a valid and active subscription with the service.

However, all of this is for nothing because it appears that enterprising coders can still find a way around these protections to enable users to permanently save tracks as mp3 files on their desktop computers, which can then be transferred onto their mobile devices.

Downloading mp3s for free from Tidal's servers

Lordmau5, a teenaged coder who recently graduated from high school, has developed TiDown, a software that figures out what the unique streaming or offline mode URL for each music track is, traces it back to Tidal's servers and then downloads the file directly onto your computer.

"I recently looked into some potential APIs and found out that it's super simple to get the stream-/offline-URL for the tracks [from Tidal] and... well... that's when the coding began," Lordmau5 told TorrentFreak.

"This is an actual downloader – you are logging into Tidal through the tool and you get the direct 'stream-URLs' that can then be downloaded."

This isn't the first time Lordmau5 has done something like this – he started off making a similar software that detected URLs for music from Spotify's servers, which worked until Spotify got wise to it and beefed up their security.

Lordmau5 doesn't expect his tool to work for long, and he has deliberately created a website that looks like a webpage from 2001 to host his software on, as the point he is trying to make is that music streaming services really need to take a much closer look at how they secure the content that is being transmitted from their servers.

Online music services really need to make sure that they are not inadvertently enabling more music piracy, especially since music artistes and record labels already have such a tense relationship with these services.

IBTimes UK has contacted Tidal about the issue and is waiting for a response.