Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am developing an application that, when bought, can be activated using a license.

Currently I am doing offline validation which is a bit troubling to me. I am aware there is nothing to do against cracks (i.e modified binaries), however, I am thinking to trying to discourage license-key pirating. Here is my current plan:

  • When the user activates the software and after offline validation is successful, it tries to call home and validate the license. If home approves of the license or if home is unreachable, or if the user is offline, the license gets approved. If home is reached and tells the license is invalid, validation fails.
  • Licensed application calls home the same way every time during startup (in background). If license is revoked (i.e pirated license or generated via keygen), the license get deactivated.

This should help with piracy of licenses - An invalid license will be disabled and a valid license that was pirated can be revoked (and its legal owner supplied with new license). Pirate-users will be forced to use cracked version which are usually version specific and harder to reach.

While it generally sounds good to me, I have some concerns:

  • Users tend to not like home-calling and online validation. Would that kind of validation bother you? Even though in case of offline/failure the application stays licensed?
  • It is clear that the whole scheme can be thwarted by going offline/firewall/etc. I think that the bother to do one of these is great enough to discourage casual license sharing, but I am not sure.
  • As it goes in general with licensing and DRM variations, I am not sure the time I spend on that kind of protection isn't better spent by improving my product.

I'd appreciate your input and thoughts.

Thanks!

share|improve this question
5  
If the home is unreachable and it gets approved, then development is a total waste of money and resources. Rightclick, disable network, install. Everyone can do that. You need phone activation instead, but it's super annoying to users. –  Coder Sep 19 '11 at 13:03
2  
You must take into account that you are getting into a legal gray area if you are "calling home" without a user's knowledge. AFAIK you have to tell the user that your program will be sending data elsewhere. –  AndrewC Sep 19 '11 at 13:42
    
If your product is expensive enough, you can use hardware keys. –  liori Sep 19 '11 at 23:01
2  
they edit the hosts file to block your IP and it will never find home, and thus never be invalidated... –  Andrew Heath Sep 20 '11 at 7:43
1  
Very easily bypassed. And if you tightened it up - well, I've had enough bad experiences with activation that I need an extremely compelling reason to buy something that needs activation, and even then I'll look for a pirate hack even though I've paid. If a company like Adobe can't ensure activation just works and can't be bothered answering support calls, and if a company like Macromedia can be bought out so that their activation systems cease to exist, what chance have you got of convincing me I can rely on your activation process? And if it's easily bypassed, what's the point? –  Steve314 Nov 4 '11 at 23:28

5 Answers 5

up vote 13 down vote accepted

This is not really a war that you can win with the approach you have lined out. As others have pointed out, simply disabling the network, or clicking "no" when the firewall asks you whether or not to allow your application to phone home, will bypass the phone-home. Aside from that, users absolutely hate this type of thing, and you may be required to explicitly have the user tick a checkbox saying that they understand what the system is about to phone home (according to the law in some countries).

So, what can you do? My advice would be:

  • Try to reward your paying customers with value-adds (frequent updates, online tutorials, etc), rather than effectively punishing them.
  • Don't worry too much about pirates. In many cases, they are unlikely to have purchased your software in the first place, the least they can do is spread awareness of your application.
  • If you really can't handle the fact that your software is going to be pirated, make it an online app (if the nature of the software is such that this is possible). There was an interesting article by a developer who made this move, and found that his web version sold far better, was far easier to identify what features users actually used (since it's not really calling home if you're already on the server), and there was far less reluctance for people to whip out their credit cards (sorry - can't find the link).
share|improve this answer
2  
"The only winning move is not to play" - War games, 1983 –  Warren P Sep 19 '11 at 16:39
    
Not only users hate this sort of thing (or at least, strongly feel against it) some industries due to specific nature of their work keep dev. machines off the net. And in those cases, regardless of software you need, you will most often not change their politics. CATIA had similar problems. –  ldigas Nov 4 '11 at 23:23
1  
+1 for the last bullet point. –  Donal Fellows Nov 6 '11 at 18:54

With anything like this you should ask yourself (or your boss) the following question:

Are the costs of developing and maintaining an anti-piracy scheme less than or greater than the losses due to piracy?

If they are less then by all means go for it. In this case I assume that your software is high value (like Microsoft Word or AutoCAD) and people are not going to fret about it calling home once is a while.

If they are greater then I'd seriously suggest you don't implement anything too complex (or indeed anything at all) and put effort into earning money from the software in other ways. You could charge for support, or for people to be on the developer program, or any number of other things.

Another thing to bear in mind is that if someone is determined to pirate your software they will and adding more layers won't stop them, but will annoy your legitimate users.

share|improve this answer
1  
+1 for that last paragraph. Beware the diminishing returns of implementing expensive and complex licensing systems! –  FrustratedWithFormsDesigner Sep 19 '11 at 14:45
4  
It is not just a matter of value, but also a matter whether the software company really wants their software to be "hard to crack". Word and ACAD didn't become industry standards because only licenced users learned&used it. –  Rook Sep 19 '11 at 15:06
5  
Rook, I contend to this day that Word became dominant because Word 2.0, zipped up, fit perfectly on a single 1.44mb floppy. –  GrandmasterB Sep 19 '11 at 18:09
1  
@GrandmasterB - Pretty much, yeah. What's more interesting, that lil' thing did almost everything I need out of a word processor. –  Rook Sep 26 '11 at 12:36

My observation is that it depends a lot on the vertical market where you're distributing your application. Some are much more prone to piracy and other unauthorized use than others. For example, I'll never release another product to the Internet marketing and SEO market without doing a "phone home" and other protections. Widespread and casual piracy is the rule in that niche. Other niche markets that I've worked in, such as medical claims processing, I'd be more comfortable with looser copy protection.

As Daniel B mentioned, moving the app online, in whole or in part, is a potential option. This is my current plan for a new app that I'm in the design phase on right now.

share|improve this answer

One concern that does not appear to be addressed here is "you've gone out of business". While this may appear to be a variation of "network is down", it is a more permanent situation. I've come across this in several developer products.

share|improve this answer
    
Well, in this case the software gets auto approved. So this isn't an issue, everyone who bought can still use it. –  VitalyB Sep 20 '11 at 7:01
    
Good point and a feature to look for in a license activation Service. Also good to mention in the purchasing process to reassure your customers. –  CAD bloke Apr 18 '13 at 5:31

From Disadvantages of dongles:

Some familiar disadvantages are that:

  • The software vendor has to buy, store and deliver a piece of hardware to each customer
  • Customers have to wait to run their license, but today users expect near-instant delivery of software
  • Customers have to keep an USB device inserted in their machine (either sticking out at the front or side, where it can be damaged)
  • If a customer wishes to move the license to another machine, they have to ship the dongle.
share|improve this answer
1  
Naked links don't make for good answers. If the page linked to disappears your answer becomes useless. Please summarise the page here (don't just cut and paste). –  ChrisF Nov 4 '11 at 23:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.