What is the best practice for detecting piracy in a SaaS or Web based app where the user can share their login? User is licensed to use the login on multiple devices. So how do you differentiate between that and sharing that login?
Approaches and issues
Detect simultaneous login on 2+ devices. Can be challenging to catch if it's not a heavy use app. (I.e., if a typical user uses it only 1 h per day then the chance of a random "collision" is fairly small. Also, what if they just log into Device1 and forget to log out and log into Device2? So you might want active simultaneous usage. Perhaps some combination like :
a. Login.Device1... login on Device2.... usage on Device1 (within same login)
Detect logins on multiple devices (but not simultaneous). They are licensed for this. Also multiple browsers on the same devices are indistinguishable (AFAIK) from multiple device logins.
Caveat: I realize that the best solution would be to add useful features that tailor the app to a specific user. We are adding such features but they are not yet required of the user.