0

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who is leaking my software? Chances are no 2 people who bought this software will compare because the price is in the thousands. Furthermore, there are limited copies so they won't even realize they are being tracked.

What is the downfall to this method and are there any better ways to do this?

  • I don't think is security related, but rather some sort of IP protection. – mootmoot Aug 20 '18 at 11:04
2

You can add an external lib to the product, made in C/C++. Python can import those just fine. Add a couple vital functions on that library, and change the library a little for each client.

An interesting way of doing this is to use internationalization to encrypt most of the strings, and use the external library to decrypt them. Use a custom key to each client, and encrypt the strings file before shipping.

1

It might be easier to assign an identifier to your product, and tie those identifier details with customers that buy the product. Another issue though is that even if someone did leak your product, it can often be very difficult to do anything about it, let alone enforcing it. So if you want to protect your product it would be wise to look into using license keys, its not a perfect method but can give an extra layer of protection.

1

I do not see a straightforward solution here, as ThoriumBR mentioned,

you can add an external lib to the product, made in C/C++. Python can import those just fine. Add a couple vital functions on that library, and change the library a little for each client.

The idea to use these external libraries for encryption I do like. A system similar to that used by intelligence agencies involves having all classified files encrypted at rest, and when requested by an employee, the file is decrypted and issued to them. This method will ensure logs can be kept for each request, and who requested a decrypted version. Although, for that environment, air-gapped networks are used, and employees are not allowed to remove material from the workplace.

I do have concerns over this, as while programming, programmers are using the source code, which might as well be equivalent to plaintext. So signing the code would not make a difference, as it would only serve to slow down the leaker if they did not want to be found afterward. So, taking measures to ensure full working code cannot be dumped on the Internet, like using external libraries which the programmers never have direct access to might actually be more ideal.

1

Is this a good way to figure out who is leaking my software?

It's viable - but you also need to build another application to track the changes applied to the code and link these to customers.

But the elephant in the room is what you intend to do when you find an unlicensed copy of the software somewhere. You merely have a very strong indicator of which legitimate customer the software came from. What do you do next? Evidence of possession alone (assuming that you can prove posession) does not demonstrate malfeasance on the part of the legitimate licencee nor the possessor. Possession of IP belonging to someone else is an issue of copyright (or patent) and in most jurisdictions copyright and tort are primarily civil matters. The police will not be interested in investigating this.

there are limited copies so they won't even realize they are being tracked

....and what happens to your reputation when the world finds out that you've been deliberately building capabilities into your software which you don't tell your clients about?

BTW in Europe I suspect that customizations deliberately intended to identify a specific individual would be considered PII under the GDPR; by not telling people about this you may the bad guy (and a lot of GDPR comes under criminal law).

  • 1
    That sounds like overinterpretation of the GDPR. A car, cell phone, computer, etc. has a serial number that can be used to track the purchaser. The databases mapping this information is PII, but nobody would argue the serial number itself is. – user71659 Aug 20 '18 at 17:53
  • So you are suggesting that a database full of PII is not covered by the GDPR????? – symcbean Aug 21 '18 at 8:43
  • The author of the software is going to have a customer database that contains PII anyway, copy protection or not. Adding unique copy protection or a serial number to each product does not, in itself, make the product subject to the GDPR because the only way to map that serial number to a purchaser is with the database. – user71659 Aug 21 '18 at 15:07
  • Recital 26 is quite explicit that a means available to the data controller for resolving an individual from a surrogate identifier is PII and in scope for GDPR. – symcbean Aug 21 '18 at 16:21
  • 1
    No. You may have your own interpretation of the law. You may have your own interpretation of what I've said above. But please don't extrapolate based on something you have no objective measure of and tell me what my opinion is. – symcbean Aug 21 '18 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.