Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How do I sell a mac app off of my website without somebody being able to copy-and-paste the app to some friends after he buys it, etc..

I understand that you can use receipt validation when selling through the Mac App Store to stop this kind of thing, but what about for selling on my website?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

The reason the Apple app store can do it is that the app approval and revocation is built in along with authentication, ie the device checks for the validity of an app for you.

You could write your app with some code specific to the buyer or the device, for example using a device specific identifier as a decryptor, but an attacker could reverse engineer that.

The general rule is that if the attacker has your code they can change it. If you want at least a small bit of protection you'll have to pay the price and use the app store.

share|improve this answer
    
Okay. Too bad I can't get the same level of protection that selling from the App Store provides. –  Hope4You Oct 8 '12 at 14:14
    
Does OS X offer the equivalent of the iOS method identifierForVendor? If so, you can build in some protection by having your server use that identifier + purchase information to create a hash value to be transmitted to and stored on the local machine. At runtime, and without need for internet connection, you could re-calculate that hash to verify its authenticity while tying it to that particular machine. –  Basil Bourque Mar 12 at 23:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.