10

I am developing an application that, when bought, can be activated using a license.

Currently I am doing offline validation which is a bit troubling to me. I am aware there is nothing to do against cracks (i.e modified binaries), however, I am thinking to trying to discourage license-key pirating. Here is my current plan:

  • When the user activates the software and after offline validation is successful, it tries to call home and validate the license. If home approves of the license or if home is unreachable, or if the user is offline, the license gets approved. If home is reached and tells the license is invalid, validation fails.
  • Licensed application calls home the same way every time during startup (in background). If license is revoked (i.e pirated license or generated via keygen), the license get deactivated.

This should help with piracy of licenses - An invalid license will be disabled and a valid license that was pirated can be revoked (and its legal owner supplied with new license). Pirate-users will be forced to use cracked version which are usually version specific and harder to reach.

While it generally sounds good to me, I have some concerns:

  • Users tend to not like home-calling and online validation. Would that kind of validation bother you? Even though in case of offline/failure the application stays licensed?
  • It is clear that the whole scheme can be thwarted by going offline/firewall/etc. I think that the bother to do one of these is great enough to discourage casual license sharing, but I am not sure.
  • As it goes in general with licensing and DRM variations, I am not sure the time I spend on that kind of protection isn't better spent by improving my product.

I'd appreciate your input and thoughts.

Thanks!

Improve this question
10
  • 6
    If the home is unreachable and it gets approved, then development is a total waste of money and resources. Rightclick, disable network, install. Everyone can do that. You need phone activation instead, but it's super annoying to users.
    – Coder
    Sep 19, 2011 at 13:03
  • 2
    You must take into account that you are getting into a legal gray area if you are "calling home" without a user's knowledge. AFAIK you have to tell the user that your program will be sending data elsewhere.
    – AndrewC
    Sep 19, 2011 at 13:42
  • If your product is expensive enough, you can use hardware keys.
    – liori
    Sep 19, 2011 at 23:01
  • 2
    they edit the hosts file to block your IP and it will never find home, and thus never be invalidated...
    – Drew
    Sep 20, 2011 at 7:43
  • 2
    Very easily bypassed. And if you tightened it up - well, I've had enough bad experiences with activation that I need an extremely compelling reason to buy something that needs activation, and even then I'll look for a pirate hack even though I've paid. If a company like Adobe can't ensure activation just works and can't be bothered answering support calls, and if a company like Macromedia can be bought out so that their activation systems cease to exist, what chance have you got of convincing me I can rely on your activation process? And if it's easily bypassed, what's the point?
    – user8709
    Nov 4, 2011 at 23:28

5 Answers 5

Reset to default
15

This is not really a war that you can win with the approach you have lined out. As others have pointed out, simply disabling the network, or clicking "no" when the firewall asks you whether or not to allow your application to phone home, will bypass the phone-home. Aside from that, users absolutely hate this type of thing, and you may be required to explicitly have the user tick a checkbox saying that they understand what the system is about to phone home (according to the law in some countries).

So, what can you do? My advice would be:

  • Try to reward your paying customers with value-adds (frequent updates, online tutorials, etc), rather than effectively punishing them.
  • Don't worry too much about pirates. In many cases, they are unlikely to have purchased your software in the first place, the least they can do is spread awareness of your application.
  • If you really can't handle the fact that your software is going to be pirated, make it an online app (if the nature of the software is such that this is possible). There was an interesting article by a developer who made this move, and found that his web version sold far better, was far easier to identify what features users actually used (since it's not really calling home if you're already on the server), and there was far less reluctance for people to whip out their credit cards (sorry - can't find the link).
Improve this answer
2
  • 2
    "The only winning move is not to play" - War games, 1983
    – Warren P
    Sep 19, 2011 at 16:39
  • Not only users hate this sort of thing (or at least, strongly feel against it) some industries due to specific nature of their work keep dev. machines off the net. And in those cases, regardless of software you need, you will most often not change their politics. CATIA had similar problems.
    – Rook
    Nov 4, 2011 at 23:23
13

With anything like this you should ask yourself (or your boss) the following question:

Are the costs of developing and maintaining an anti-piracy scheme less than or greater than the losses due to piracy?

If they are less then by all means go for it. In this case I assume that your software is high value (like Microsoft Word or AutoCAD) and people are not going to fret about it calling home once in a while, especially in today's "always online" world.

If they are greater then I'd seriously suggest you don't implement anything too complex (or indeed anything at all) and put effort into earning money from the software in other ways. You could charge for support, or for people to be on the developer program, or any number of other things.

Another thing to bear in mind is that if someone is determined to pirate your software they will and adding more layers won't stop them, but will potentially annoy your legitimate users.

Improve this answer
4
  • 1
    +1 for that last paragraph. Beware the diminishing returns of implementing expensive and complex licensing systems!
    – FrustratedWithFormsDesigner
    Sep 19, 2011 at 14:45
  • 4
    It is not just a matter of value, but also a matter whether the software company really wants their software to be "hard to crack". Word and ACAD didn't become industry standards because only licenced users learned&used it.
    – Rook
    Sep 19, 2011 at 15:06
  • 5
    Rook, I contend to this day that Word became dominant because Word 2.0, zipped up, fit perfectly on a single 1.44mb floppy.
    – GrandmasterB
    Sep 19, 2011 at 18:09
  • 1
    @GrandmasterB - Pretty much, yeah. What's more interesting, that lil' thing did almost everything I need out of a word processor.
    – Rook
    Sep 26, 2011 at 12:36
7

One concern that does not appear to be addressed here is "you've gone out of business". While this may appear to be a variation of "network is down", it is a more permanent situation. I've come across this in several developer products.

Improve this answer
2
  • Well, in this case the software gets auto approved. So this isn't an issue, everyone who bought can still use it.
    – VitalyB
    Sep 20, 2011 at 7:01
  • Good point and a feature to look for in a license activation Service. Also good to mention in the purchasing process to reassure your customers.
    – CAD bloke
    Apr 18, 2013 at 5:31
1

My observation is that it depends a lot on the vertical market where you're distributing your application. Some are much more prone to piracy and other unauthorized use than others. For example, I'll never release another product to the Internet marketing and SEO market without doing a "phone home" and other protections. Widespread and casual piracy is the rule in that niche. Other niche markets that I've worked in, such as medical claims processing, I'd be more comfortable with looser copy protection.

As Daniel B mentioned, moving the app online, in whole or in part, is a potential option. This is my current plan for a new app that I'm in the design phase on right now.

Improve this answer
0

From Disadvantages of dongles:

Some familiar disadvantages are that:

  • The software vendor has to buy, store and deliver a piece of hardware to each customer
  • Customers have to wait to run their license, but today users expect near-instant delivery of software
  • Customers have to keep an USB device inserted in their machine (either sticking out at the front or side, where it can be damaged)
  • If a customer wishes to move the license to another machine, they have to ship the dongle.
Improve this answer
1
  • 1
    Naked links don't make for good answers. If the page linked to disappears your answer becomes useless. Please summarise the page here (don't just cut and paste).
    – ChrisF ♦
    Nov 4, 2011 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.