Hot answers tagged

37

In short: yes. Any software can harm you. Legally: If the authors of the software find you are using illicit copies of their software, they are at liberty to file a civil copyright infringement claim against you. Software commonly "phones home", even in the form of checking for new updates. They may not go after you if you're a poor individual, but they ...


28

I'm not an expert in the matter, but if you have a legitimate copy of the software in question and not a "cracked" copy then the main concern for you would be that the company that created the software would know that the key you used is not yours (you're the 300th person to use it). From there they could either prevent the software from working or attempt ...


22

If there is no real need for security, then here is a very fast serial number generator, with a checker: User a counter. Initialize it at 0. When you want a new serial number, increment your counter by 1000; the new counter value is the serial number. The checker works like this: a serial number is valid if it ends with three zeros. Only one of every 1000 ...


19

The license generation method isn't really that important, as long as it's non-trivial. The trick is how your client verifies that the license is correct. Let's say you do something like this: BOOL verifyLicense (char* licenseKey) { BOOL result = false; if(strlen(licenseKey) > 128) return false; char* url = (char*)malloc(1024); ...


17

One thing that has not been mentioned in the other answers: although using an illicit key might or might not be harmless, it usually correlates with malware infections - the key-generator, the key distribution website etc. are likely to contain trojans or other malware targetted at the less-savvy users.


15

No. Only the manufacturer of the software can know what key you have used and only if the software "calls home" for (re-)activation. Using a non-original key (for example, one provided by a key generator) will not give anyone back-door access to your computer/program.


6

With the standard engine, you can't. There are a number of code obfuscator available as well as several PHP code protection tool but none will offer you good protection against an attacker who knows what he's doing. There is one additional issue that I read in your description of your problem: you seem to want to protect passwords or other secret data using ...


6

Sign Your License File You want to sign the data with your private key to create a signature. Generate a license file Sign the file with your private key. Provide the public key with your application In your program, verify the file contents have not changed with your public key. The signature cannot be replaced since only you have the private key to ...


5

A lot of software "calls home" nowadays. So using a cracked key, you may be broadcasting to the software editor that you pirated the product. Whether they sue you or not is their prerogative, but that sure looks like harmful to me.


5

If you want the cryptographically secure method you won't get around an internet connection to verify the serial. This means that such a protection scheme is better suited for subscription based software than it is for traditional shelf software. With internet connections it's simple (since you use JS, I assume that's the one you want): Someone creates a ...


5

No. You want to ensure license file's integrity by using a public key to verify. However, if you let your app receive the public key with the license file, an attacker ( who want to change the license file ) could just change the content, generate a new key to sign the content and replace your key with their key. And your app will use attacker's public key ...


4

However, once the license key is hashed (with salt) - it becomes very difficult to check if a given key exists in the database - since the salt used will change with each key. Salts are designed to be used when you already have an identifier to look up the corresponding hashed field. For example, you don't look to see if "password" exists in any of the ...


4

Let's state things clearly: there is such a thing called asymmetric encryption. There is another, completely different thing called digital signatures. Whenever you see some text that talks about "decryption with the public key", then that text is really talking about signatures, and is trying to explain signatures as if it was some kind of encryption, which:...


3

Well, you know that every software in the end-user (be it a client, a regular costumer that is viewing a video, etc) can be reverse-engineered. And that applies to any solution like "download the keys from a server", because once your program is descompiled, the user has access to it. I don't think anyone here will be able to give you a better solution ...


3

OP wrote "it should be very easy to implement (in javascript) and it should be very fast" Its not clear whether "in javascript" refers to the generator or the checker or both, or whether it refers to "javascript in the browser", or some other java/ecmascript implementation (e.g. server-side in the web server). Javascript as an implementation language isn't ...


3

Higher authorities could easily find out about criminal activity - such as drug trafficking and child pornography - being conducted on a laptop simply by hacking into it or somehow seeing the history. No, they find it out from the web history/logs, which is with the internet service provider (verizon, comcast, etc). They don't need access to the computer ...


3

http://crackmes.de/ is perhaps the most comprehensive website in this category. Also Keygen challenges at http://tuts4you.com/download.php?list.51 are good .


3

Your design is the basically the same as most licensing systems. One extra step is to obfuscate your application, so it is more difficult to decompile. How secure is this? It will certainly hinder a typical user. In fact, even the older system with an embedded key will stop most users. While you say it is easy to extract the key, that is from the point of ...


2

You are ethically obliged to report it, but for your own protection you should do it anonymously. There are some companies which welcome people for pointing out security flaws in their products. Some even have public bug bounty programs where they financially reward people for doing so. But unfortunately not all companies have that stance. There are also ...


2

Each device has a unique hardware-ID - We will call it HID for readability. Create an algorithm that takes the HID and generates an unlock-serial-number Pseudo-code: Generate_Serial(input = HID) { scramble that HID add a secrete value to it send the value to costumer } Have a sms/phone-calls bot to answer requests coming from your clients ...


2

Given the comment answer I would say that is a good enhancement of your existing architecture. Specifically, you can trigger alarms if your example different machine IDs appear for the same key in a close timeframe, lets say 1 week or even 1 month (reinstallation of a broken hardware right after first time installation can happen, but is unlikely). In this ...


2

See comments - the licence information is signed with the private key, and validated using the public key. In this case, the public key can be 100% public - no-one else should be able to sign data with the private key (as long as that is kept secret), and there is no (known) way to get back to the private key from a public key. Publish it on your website, ...


2

You need a trust anchor. In x509 PKI systems (used for TLS, S/MIME email, and code signing, among others), the trust anchor is provided by public certificate authorities. Your public key (your certificate) is signed by the certificate authority, which the user implicitly trusts. To forge a certificate that specified your or your organization's name, an ...


2

As pointed out by @王庭茂 and @LieRyan, you need some way to prove that the public key that gets uploaded with the license file actually came from your company and wasn't planted there by an attacker (in your case, someone trying to forge a license file without paying). The solution to this is to have your public key made into a certificate. Looking at your ...


1

This obviously depends on what type of software you are talking about, and what position the persons who cracked it are in. If the system connects to some central server on a regular basis to verify that the product is legitimate, and that it is unlocked with a legitimate key, then I suppose there is a chance that someone could get compile a list of users ...


1

BLS is the traditional scheme for your situation. This paper gives two potential alternatives, "Very Short Weakly Secure Signatures" and "Concrete Short Hash-Signature Scheme with Random Oracles". However, this paper gives an attack on the former alternative for most groups which becomes significantly faster than solving discrete log to get the private key ...


1

consoles these days are completely closed ecosystems, to the point where their components are not even interchangeable ( for example a Xbox internal hard drive cannot be inserted into another xbox, or the flash memory which stores the operating system and settings on the Nintendo 3ds is encrypted with a key which is unique to the console ) They are not ...


1

Perhaps it goes against your current projects intentions - however - you should try and avoid selling products to clients which are bundled in this way and where they have direct and absolute control over the source. (I assume they would be hosting your application on a local server? They would need some kind of technician and would they have to know your ...


1

Look up SLP server, a former Microsoft product. It handles the obfuscation, encryption, and limited use (and reporting) you're looking for.


1

The trick isn't implementing the feature: that's basic timekeeping, file use, subtraction, etc. The trick is ensuring they don't bypass it. The body of tricks you must google for that is called "code obfuscation techniques." If this was easy, there wouldn't be entire industries producing and countering them. The major tech in this area is DRM, which is ...



Only top voted, non community-wiki answers of a minimum length are eligible