Web Development

Ask something
Discussion Locked

How Do I Secure My App?

0 helpful
7 replies

by jeff12321

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm looking for good information about ways to
1. Use a licence key or the like.
2. Ways to prevent (or at least to make it hard) to install it on other computers with the same code.
3. Make it usable for only a specific amount of days (i.e. 30 days). (also, possible ways, if they exist, to not use system clock, such as an internet clock with and without the need to be connected after entering the code)
4. How to hide this information, if possible also from installation tracking programs.

7 replies

by timthetoolman

Hi,

1. A self extracting password protected ZIP file would give you equal protection to a license key.

At least it would if you made configuration changes at installation time such that it couldn't easily be picked up off the system post-install. Maybe registry entries at least. But its not a good protection, as invariably an illegal copy comes along with a serial number.

2. Now this is where it gets philosophical.

In order to do that you need to "sniff" their network looking for a duplicate license. Thats the best you can get... and you're going to have a major problem if people dont want you snooping their network... I think I'd be one of them!

And as far as other computers go? Well how can you tell if the same software used the same license number when they're on the other side of the world?

I mean you cant poll the world's PCs can you!

So you need to have the PC send something to you when it installs. Most companies call it registration. But more cunning ones call it "online updates". Dont ever register with illegal software or you'll be lighting up a neon light over your head saying I'm using your software illegally and I'm over here!

Whether they choose to do anything with that information is up to them, of course.

And to do more again, the other technique Microsoft have adopted is to take the information you send to them at registration (only they do it at "authentication"), munge it around and send it back - which then becomes integrally incorporated into a few key areas of the application.

Unfortunately to ensure the software hits only one PC, its necessary to send something unique about the PC back. Microsoft have copped a lot of flack about people believing they're sending confidential hardware configuration information. Its not actually true, but its people's perceptions that matter.

Thats the first questions discussed, anyway.

Cheers,
Tim.

by timthetoolman

For the other questions...

3. I'd never seriously thought about how this might be done before so here is an attempt.

I'd not have the installation do anything other than install the version with the date checking software enabled within it. I'd write the date checker to be integral to the correct running of the software so that it couldn't easily be cracked.

On the first run I'd create an innocuous registry key and enter the value 1, the current date and a GUID into them. They should be encrypted together. Store the GUID in a verification file somewhere with your system or better yet, alter the EXE file itself to include it. Yes, write to your own application!

On subsequent runnings, I'd check the GUIDs match and check system date against the entered date and increment the counter by the number of days that has passed.

If the counter was greater than 30, then disable the software.

4. This method has the advantage of taking care of "4" as well because there is nothinghappening during the install.

Furthermore, it doesn't matter if the pirate sets his clock back because your comparing the counter rather than dates.

Also a re-install wont help because you only create the registry keys if they dont exist, so the originals will still be in place.

And the key must match the installation because of the pair of GUIDs (Remember the registry key must be encrypted for this to work) so the pirate cant blow away the key or the GUIDs wont match.

So the only solution to keep the software running is to find and remove that key along with all the software and re-install from scratch.

For the average Joe, this means a reformat, reinstall.

Interesting question. I hope I've helped.
Cheers,
Tim.

by shanrali

Hi,
1. Yes You can create your licence key by using hashing technique, which is also embedded into your software. And you can check the Hash for your approval.
2. For automated expiration, like all other demo s/w companies, you can set your timerwhen it is installed and you can check the timer for the expiration. If the current timer value is exceeds the fixed value you can design the s/w to exit from that.
3. By using some hacking, through registry of windows, you can receive the message from the installed computer. Based on that you can warn them not to use the illegal copy.
I think this will help you to solve your problem.

This discussion is closed to new replies.