What is the best practice for detecting piracy in a SaaS or Web based app where the user can share their login? User is licensed to use the login on multiple devices. So how do you differentiate between that and sharing that login?

Approaches and issues

  1. Detect simultaneous login on 2+ devices. Can be challenging to catch if it's not a heavy use app. (I.e., if a typical user uses it only 1 h per day then the chance of a random "collision" is fairly small. Also, what if they just log into Device1 and forget to log out and log into Device2? So you might want active simultaneous usage. Perhaps some combination like :

    a. Login.Device1... login on Device2.... usage on Device1 (within same login)

  2. Detect logins on multiple devices (but not simultaneous). They are licensed for this. Also multiple browsers on the same devices are indistinguishable (AFAIK) from multiple device logins.

Caveat: I realize that the best solution would be to add useful features that tailor the app to a specific user. We are adding such features but they are not yet required of the user.

  • 3
    This is really difficult/impossible to do. If your app has a resource like “video playback” or “convert document”, you can restrict or rate limit use of the resource (e.g. Netflix accepts account sharing, but limits the number of simultaneous video streams). Points to consider: Does detecting piracy have any business value? If you prevent pirates from sharing accounts, would they actually start paying? Or would they stop using your service? Can you adjust your pricing structure to influence this? Will your anti-piracy measures annoy valuable users, perhaps causing the to cancel your service? – amon Dec 14 '16 at 17:31
  • I think Steam handles this well - it allows multiple simultaneous logins, but only one instance may play games at a time. (Playing games is the reason to use Steam. Its other features - shopping, chat, profile management - can be done from all logins, because why not?) Other logins will see that the user's game collection is in use. – WolfeFan Dec 14 '16 at 23:32

So my first piece of advice as a consumer of web services is use a light touch with this kind of thing. Without knowing what kind of service you are providing it is hard to say what is too much or too little.

For example a service licensed to established enterprise customers (B2B) may need very little in the way of enforcement as those clients have internal compliance departments and are used to being audited. While a service licensed to the general public is on the other end of the spectrum.

If it is normal consumer facing web service (video, chat, ..etc.). I would expect that allowing a certain number of simultaneous logins (1+) and invalidating the oldest login first could work.

Alternatively you could restrict things at the content layer instead. For example Amazon will allow me to login from tons of different devices (fire tv, iphone, 2-computers, kindle) simultaneously but it only allows me to stream video from one at a time. If I go over that then it tells me that I forgot to stop streaming on one of my other devices. But it does allow me to stream video, shop, download an ebook, ..etc simultaneously across all my devices if I need to.

Without knowing more about your service, potential customers, ..etc it is hard to say what would be effective while staying out of the way.

I would focus more on the product. If you build something that provides value people generally will pay you for it. If you make it hard for them to use it because there are some bad actors then they will just get frustrated and leave.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.