Tag Info

Hot answers tagged

18

The license generation method isn't really that important, as long as it's non-trivial. The trick is how your client verifies that the license is correct. Let's say you do something like this: BOOL verifyLicense (char* licenseKey) { BOOL result = false; if(strlen(licenseKey) > 128) return false; char* url = (char*)malloc(1024); ...


17

If there is no real need for security, then here is a very fast serial number generator, with a checker: User a counter. Initialize it at 0. When you want a new serial number, increment your counter by 1000; the new counter value is the serial number. The checker works like this: a serial number is valid if it ends with three zeros. Only one of every 1000 ...


6

With the standard engine, you can't. There are a number of code obfuscator available as well as several PHP code protection tool but none will offer you good protection against an attacker who knows what he's doing. There is one additional issue that I read in your description of your problem: you seem to want to protect passwords or other secret data using ...


5

If you want the cryptographically secure method you won't get around an internet connection to verify the serial. This means that such a protection scheme is better suited for subscription based software than it is for traditional shelf software. With internet connections it's simple (since you use JS, I assume that's the one you want): Someone creates a ...


4

Sign Your License File You want to sign the data with your private key to create a signature. Generate a license file Encrypt the file with your private key (signing it). Provide the public key with your application In your program, decrypt and verify the file contents have not changed with your public key. The signature cannot be replaced since only ...


4

However, once the license key is hashed (with salt) - it becomes very difficult to check if a given key exists in the database - since the salt used will change with each key. Salts are designed to be used when you already have an identifier to look up the corresponding hashed field. For example, you don't look to see if "password" exists in any of the ...


3

Well, you know that every software in the end-user (be it a client, a regular costumer that is viewing a video, etc) can be reverse-engineered. And that applies to any solution like "download the keys from a server", because once your program is descompiled, the user has access to it. I don't think anyone here will be able to give you a better solution ...


3

OP wrote "it should be very easy to implement (in javascript) and it should be very fast" Its not clear whether "in javascript" refers to the generator or the checker or both, or whether it refers to "javascript in the browser", or some other java/ecmascript implementation (e.g. server-side in the web server). Javascript as an implementation language isn't ...


3

Higher authorities could easily find out about criminal activity - such as drug trafficking and child pornography - being conducted on a laptop simply by hacking into it or somehow seeing the history. No, they find it out from the web history/logs, which is with the internet service provider (verizon, comcast, etc). They don't need access to the ...


1

Perhaps it goes against your current projects intentions - however - you should try and avoid selling products to clients which are bundled in this way and where they have direct and absolute control over the source. (I assume they would be hosting your application on a local server? They would need some kind of technician and would they have to know your ...


1

Each device has a unique hardware-ID - We will call it HID for readability. Create an algorithm that takes the HID and generates an unlock-serial-number Pseudo-code: Generate_Serial(input = HID) { scramble that HID add a secrete value to it send the value to costumer } Have a sms/phone-calls bot to answer requests coming from your clients ...


1

You are ethically obliged to report it, but for your own protection you should do it anonymously. There are some companies which welcome people for pointing out security flaws in their products. Some even have public bug bounty programs where they financially reward people for doing so. But unfortunately not all companies have that stance. There are also ...


1

I guess it all depends on which company it is. But as an answer, I would recommend not to notify. Because if the company decides to sue, you're going to lose so much time and effort for nothing. And even if this has a low chance to happen, particularly with smaller companies, the risk balance is still very bad. I have been in the same case as you, and ...


1

For additional protection than encoding already gives, deviating from a standard PHP build would offer some advantages, and you could use a custom C based module where the key is compiled into the module and not existing within the PHP code. However consider what protection there is to the data before it is encrypted; PHP itself is opensource and can be ...


1

When you deliver a working system into the hands of your attacker, you cannot prevent them from reverse-engineering it. There are no exceptions. But with clever distribution of keys and certificates, you can alleviate some of the trouble. If each user gets his own key and certificate (signed by you), then you can uniquely identify that user by anything he ...


1

You need a timestamping service. The license server should track information about the client that ensures that the same client can not request a license more than once. You can use any number of factors for this such as hard drive serial numbers, windows activation codes, etc. When an evaluation license is issued, you can timestamp the key and have the ...


1

I'm not sure what sort of software are you distributing. Are you Selling software to game development/hosting companies? Selling access to software hosted on your servers? If it's 1), have you ever considered using the power of the law to your advantage? Basically sue the pants off any company who uses your software without permission. If it's 2), you ...


1

Not a lawyer, but your company probably owns your code (this is typical). You do not have permission to release it to the world. At the very least your employer can justifiably terminate your employment based on this -- and you have to be careful that you don't include any non-GPLv3 code with the GPL parts. If the code is GPLv3, then if that code is ...


1

If all you are trying to do is generate a license key that is hard to replicate then by using the username as part of the input to the hash you are actually going to make the license key weaker, and therefore easier to guess. The username is non-random and therefore decreases the entropy of the resulting license key, and the username can be guessed by the ...


1

Here is an article I find very informative regarding generating secure license keys: How to Generate License Keys Securely It's about using elliptic curve cryptography to generate license keys. The generated keys can be as small as 20 characters and still secure.


1

Since your comment clarified that you need to deliver a whole machine (or VM) and if you have that in mind then you're into a different ballgame. Forget trying to do anything to or with the PHP, it's not secure when the attackers have access to it and trying to make it that way is arguably a fools errand. Delivering the whole machine however has much more ...



Only top voted, non community-wiki answers of a minimum length are eligible