Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I sell a mac app off of my website without somebody being able to copy-and-paste the app to some friends after he buys it, etc..

I understand that you can use receipt validation when selling through the Mac App Store to stop this kind of thing, but what about for selling on my website?

share|improve this question
up vote 2 down vote accepted

The reason the Apple app store can do it is that the app approval and revocation is built in along with authentication, ie the device checks for the validity of an app for you.

You could write your app with some code specific to the buyer or the device, for example using a device specific identifier as a decryptor, but an attacker could reverse engineer that.

The general rule is that if the attacker has your code they can change it. If you want at least a small bit of protection you'll have to pay the price and use the app store.

share|improve this answer
Okay. Too bad I can't get the same level of protection that selling from the App Store provides. – Hope4You Oct 8 '12 at 14:14
Does OS X offer the equivalent of the iOS method identifierForVendor? If so, you can build in some protection by having your server use that identifier + purchase information to create a hash value to be transmitted to and stored on the local machine. At runtime, and without need for internet connection, you could re-calculate that hash to verify its authenticity while tying it to that particular machine. – Basil Bourque Mar 12 '14 at 23:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.