I want to make a downloads managing system on my website, that when you purchase a download, you can always re-download it again for free. (i have read that Steam does something similar)

The problem is, that someone would be able to create a account, purchase something and then give the account password to friends and family, so they can all download copies for free.

Is there a way to prevent this? Or is it impossible.

  • 2
    Possible? To a good approximation, yes. Worthwhile in terms of effort vs. business value? Probably not. A dedicated adversary will always be able to fool your PC-detecting routine. Aug 25, 2014 at 15:07
  • @KilianFoth do you have a idea how it happens on steam? (i don't know because i don't use it). Or does Steam have the same problem?
    – JoJo
    Aug 25, 2014 at 15:10
  • 3
    Steam has the same problem. DRM is security through obscurity. You're introducing more hoops to jump, and this will deter some people, but not the most determined. You can't give someone encrypted content and the decryption key and expect to control the encrypted content.
    – Doval
    Aug 25, 2014 at 15:15
  • Potentially helpful, related sort of question: programmers.stackexchange.com/questions/214158/…
    – BrianH
    Aug 25, 2014 at 15:57
  • Could your friends and family buy games as well? That's one reason not to give out this information. What do you do when they put your files on a USB stick and pass it around?
    – JeffO
    Aug 25, 2014 at 16:41

3 Answers 3


In the age of the Internet, copy protection is a fool's errand, and it's never worth your time and effort to even try.

Consider Microsoft, who spends more resources on R&D in a single month than you'll ever have in your entire life put together. They're obsessive about copy protection, and yet the latest version of Windows had a crack available before RTM. If they can't pull it off, why would you ever think you have a chance?

The deck is stacked against you from the beginning. First, we have the theory. You can frame the basic issue here as the fundamental problem of cryptography: Alice wants to send a message to Bob, and ensure that Charlie is not able to read it even if it should fall into his hands. Except in this case, Bob and Charlie are the same person.

Now we have the details. If your system downloads something when a person gives the right account credentials, then a person with the right account credentials can download it. It's really that simple, and any additional complexity you introduce will cause unhappy customers.

A central server makes sure that you're logged in properly before the software will launch? Nice going, bozo. Now anyone with a flaky Internet connection can't use what they legitimately bought and paid for.

A server ensures the user isn't logged in twice at the same time? You just tossed a dozen very useful testing scenarios out the window.

Fingerprint the computer so they can't re-download to a different system? Sounds great, right up until that computer dies and they get a new one.

Bottom line: don't even try. It doesn't work. Never has, never will, never can. All you end up doing is wasting money, annoying your customers, and driving them away. There is one and only one way to make money in software, and that's basic market economics: Sell your product for less than what the prospective buyer sees as its value to him, and he will pay for it.

  • Thank you for this very useful answer. You are absolutely right!
    – JoJo
    Aug 25, 2014 at 15:32
  • 2
    Yes, but let's be realistic for a second. Something like 80% of users will be deterred by the same old basic, well-known copy protection routines that have been known for decades; you can't do anything about the rest of them.
    – Casey
    Aug 25, 2014 at 15:42
  • @emodendroket: Considering that something like 80% of people are honest anyway,, what that's actually saying is that the same old basic, well-known copy protection routines do nothing at all to deter the dishonest ones, which is the point I was making. ;) Aug 25, 2014 at 16:21
  • 1
    @MasonWheeler I'd argue that just a little bit of fiddling might make it feel more illicit than if you could just copy it and give it to someone with no protection at all.
    – Casey
    Aug 25, 2014 at 16:55
  • 2
    Plus it would also dissuade users who don't have the technical sophistication to defeat whatever protection you put in place (which is probably most of them; many people cannot even successfully use programs as intended).
    – Casey
    Aug 25, 2014 at 17:05

The best thing I can think of is to detect if someone has logged in to the user account from multiple locations at the same time. If you detect that UserA has logged in from ComputerA, and then again from ComputerB, without logging out from ComputerA first, it's possible that two different people are both useing the account of UserA. In that case, you can prevent the login from ComputerB, until the account is logged out from ComputerA (or the session expires after a period of time). You'd have to identify the different computers by IP address or something like that.

Of course, it's also possible that the legitimate owner of UserA's account is using two machines near each other, but somehow appearing to connect to your server from two different locations. Maybe a home PC connected to the internet via an ISP, and a smartphone in their hand that's connected via the wireless phone company, not the same network as the PC.

And then there's also the problem of users behind a NAT sharing the account: you might only be able to identify two logins from the same IP address... what then? Is it two machines or one?

You could require the user change their password every now and then, but the owner of the account will just share that new password with their friends, and this could make the system even less convenient to use, and people might not want to use it.

I don't think there's any technological solution to this problem that can work 100%, so you'll have to think of another way to discourage users from doing this.

Maybe by offering users the chance to "gift" a few free files to their selected friends now and then (and maybe how much a user can gift is based on how much they spend ;) ), they'll be less discouraged to sharing full access to their accounts.

  • 1
    Very useful. The gift idea is pretty good! thank you! if i could upvote i would have done it ;)
    – JoJo
    Aug 25, 2014 at 15:33

You might limit the number of downloads allowed per purchased item to prevent the scenario you describe. This won't prevent piracy, of course, but it will prevent people from copying the game in large numbers by sharing accounts. You might set a limit of 5 or 10 downloads (only count finished downloads), and then require they contact tech support if for some reason they need more than that.

I agree with others - you're not going to stop piracy. All it takes is one copy out on a torrent site and anyone who wants it can have it. So the best strategy, imo, is to make casual copying of the program inconvenient enough to encourage people to purchase.

  • also a very good idea! thank you! it would maybe even better that this number gets resetted every month... so you can for example only download it 2 times/mo
    – JoJo
    Aug 25, 2014 at 16:48
  • @JoJo if you track each download (as a row in a table), you could enforce X per month without having to reset any values at the beginning of each month by just querying for the number of downloads in the last 30 days. Aug 25, 2014 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.