I am writing a program, or starting at the very beginning of it, and I am thinking of purchase verification systems as a final step. I will be catering to Macs, PCs, and possibly Linux if all is said and done. I will also be programming this for smartphones as well using C++ and Objective-C. (I am writing a blueprint before going head first into it)

That being said, I am not asking for help on doing it yet, but what I’m looking for is a realistic measurement for what could be expected as a viable and ethical option for purchase verification systems.

Apple through the Apple Store, and some other stores out there have their own "You bought it" check.

I am looking to use a three prong verification system.

  1. Email/password
  2. 16 to 32 character serial number using alpha/numeric and symbols with Upper and lowercase variants.
  3. MAC Address.

The first two are in my mind ok, but I have to ask on an ethical standpoint, is a MAC Address to lock the software to said hardware unethical, or is it smart?

I understand if an Ethernet card changes if not part of the logic board, or if the logic board changes so does the MAC address, so if that changes it will have to be re-verified, but I have to ask with how everything is today.

Is it ethical to actually use the MAC address as a validation key or no? Should I be forward with this kind of verification system or should I keep it hidden as a secret? Yes I know hackers and others will find ways of knowing what I am doing, but in reality this is why I am asking.

I know no verification is foolproof, but making it so that its harder to break is something I've always been interested in, and learning how to program is bringing up these questions, because I don't want to assume one thing and find out it's not really accepted in the programming world as a "you shouldn't do that" maneuver.

I am just learning how to program, and I am just making sure I'm not breaking some ethical programmer credo I shouldn't.

  • 1
    This article on MAC Addresses, UDIDs, and Privacy summarizes your issues pretty well. Oct 10, 2012 at 17:25
  • But does it really answer the ethical question... it talks about UDIDs and how Apple isn't meant to be, and Mac Addresses can be spoofed... but does it really does question the ethical question...?
    – Matt Ridge
    Oct 10, 2012 at 18:10
  • 1
    What is the ethical question? Oct 10, 2012 at 18:15
  • As programmers, do we ethically have the right to actually use the MAC Address, or are there stipulations in where it should be acceptable or other places not?
    – Matt Ridge
    Oct 10, 2012 at 18:25
  • 1
    My Android's MAC address is one thing on bootup, but if I toggle WiFi, it gets set to a different address (but always the same one). 'Tis odd, but makes me think that MAC addresses nowadays aren't as static as they're supposed to be.
    – Izkata
    Oct 10, 2012 at 21:50

2 Answers 2


This article on MAC Addresses, UDIDs, and Privacy covers your issues pretty well.

To summarize:

  1. MAC addresses are not private.
  2. Spoofing a MAC address is difficult enough to make it an adequate safety measure.
  3. You can voluntarily anonymize the MAC address if privacy is a concern.

Since MAC addresses are transmitted with every IP packet that the user sends, whether you keep your checking mechanism secret or not is kind of a moot point.

  • 1
    Why wouldn't it be? Oct 10, 2012 at 18:29
  • 4
    "Spoofing a MAC address is difficult enough to make it an adequate safety measure." -- Are you sure that's true? I thought that spoofing MAC addresses was fairly easy. (I could easily be wrong.) Oct 10, 2012 at 18:40
  • 1
    @KeithThompson - for the average user, yes, it's reasonably difficult. For a reasonably skilled programmer... not so much.
    – user53019
    Oct 10, 2012 at 18:41
  • 7
    @GlenH7: It was easy for a reasonably skilled programmer way back in the 90s. Today, pretty much anyone can do it if they want to, because the reasonably skilled programmers have created tools for it. Oct 10, 2012 at 18:42
  • 1
    @GlenH7 : The beauty of software.... It only needs one great programmer and its done for everyone. Imagine how easy it is for everyone if it just needs a "reasonably skilled" programmer.
    – mattnz
    Oct 10, 2012 at 21:52

It depends but this is far more of a business question than an ethics question or a programming question.

If you sell me a 99 cent game and I find out that I have to re-purchase the game (or spend half an hour of my time dealing with tech support) because I needed to swap out my network card, I'll probably experience some minor annoyance. If you sell me a $999 product that I depend on to do my job and I find that I have to re-purchase the product because of that same network card swap, I'm likely to be irate.

Are you going to be able to test all the ways that this sort of a check could go wrong? For example, what happens if you purchase the product on your laptop while you're using your ethernet card and then undock and start using your wireless card? If that causes the application to hiccup, you're going to have an unhappy customer and, hopefully, a call to support. Then throw in users that have one or more VPN connections, virtual machines, etc. and one machine can end up with a rather large number of MAC addresses (I have 7 on my laptop right now). Whether it is worth it to you to test all the possible configurations, to make sure that your application handles the various transitions successfully, etc. and whether you're prepared to deal with the support calls when it doesn't depends heavily on your business model. If my new 99 cent game is flaky, I'm probably not calling support, I'll just leave a bad review. If my server's new $100,000 piece of enterprise software needs a very specific (and well documented) network configuration in order to work correctly, I'll spend hours making sure that we're using exactly the right configuration.

From an ethical standpoint, I would argue that the only requirement of ethical behavior is transparency. In general, if I have a license for 1 copy of a particular software product, I can install that product on one machine at a time but I can freely move it from one machine to another when I upgrade my hardware. If you are going to restrict your software more than this, you should make that clear at the time of purchase so that your customers aren't upset 6 months later when they're setting up their new machine.

  • I thought about these scenarios already, and this is what I came up with. If you have multiple components in a computer have multiple MAC Addresses, the program would record and use it as a validation system. So if you go wirelessly or Wired, or even Bluetooth, it won’t matter, it will be recorded to show you are the owner of said software. If you switch cards, you still have a file on your computer, if it shows and validates the records correctly that you owned the old cards through the other two forms of ID, then the license would be re-activated under the new MAC Address.
    – Matt Ridge
    Oct 10, 2012 at 19:05
  • 2
    @MattRidge - It is certainly possible to build this sort of validation, it's just a question of how much time it is worth to you, how much piracy it prevents, and how much annoyance it causes to your users. If you are storing this information on a file on the user's computer, though, it's going to prevent 0 piracy because the pirates will simply update the file. Oct 10, 2012 at 19:09
  • There would be a verification system on a server, to verify the validation of said file. I think honestly that piracy is always a battle that is often lost by better hackers, but in reality it is a war that you either choose to fight or not.
    – Matt Ridge
    Oct 10, 2012 at 19:29
  • 3
    @MattRidge - Which is why it is much more of a business question than a programming question. Any anti-piracy system will have false positives that incorrectly cause grief for legitimate users. Any anti-piracy system will have false negatives that allow pirates to use the software. Any anti-piracy system has a non-zero cost to develop, test, and support. The business side of the house has to figure out where the break-even points are and whether any particular anti-piracy system is worth implementing given your customers, your product, and your environment. Oct 10, 2012 at 19:40
  • Which is why I was asking about the ethicy of doing something like that to protect against piracy ultimately. Before I was told that taking someones information for protection was a nono, I wanted to know if it changed at all at specific types or not.
    – Matt Ridge
    Oct 10, 2012 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.