Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, each legitimate copy will have its own serial number and hardware token.
We are thinking that when the application starts up, it will show a login screen where the user is supposed to enter the OTP from the token. The token will generate OTP based on serial number, the current time, and a secure algorithm. THe application will authenticate the entered OTP. We are hoping that with this mechanism, one copy of the software will only be usable by one person (who owns the OTP).
The purpose is to stop casual users from copying the software (e.g. to friends, family). We know this isn't 100% secure, and I can think of many ways serious pirates can still copy the software illegitimately. But in this case, we are interested in stopping casual users to copy the software (e.g. to friends, family, etc.) which are normal behaviour here. Is there anything to worry about using this method. The most worrying flaw that I can think so far is that the user can manipulate the local time of the computer (this is very easy to do in Windows). Is there any reliable time-keeping in a computer that is hard to tamper with?