Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am writing a program, or starting at the very beginning of it, and I am thinking of purchase verification systems as a final step. I will be catering to Macs, PCs, and possibly Linux if all is said and done. I will also be programming this for smartphones as well using C++ and Objective-C. (I am writing a blueprint before going head first into it)

That being said, I am not asking for help on doing it yet, but what I’m looking for is a realistic measurement for what could be expected as a viable and ethical option for purchase verification systems.

Apple through the Apple Store, and some other stores out there have their own "You bought it" check.

I am looking to use a three prong verification system.

  1. Email/password
  2. 16 to 32 character serial number using alpha/numeric and symbols with Upper and lowercase variants.
  3. MAC Address.

The first two are in my mind ok, but I have to ask on an ethical standpoint, is a MAC Address to lock the software to said hardware unethical, or is it smart?

I understand if an Ethernet card changes if not part of the logic board, or if the logic board changes so does the MAC address, so if that changes it will have to be re-verified, but I have to ask with how everything is today.

Is it ethical to actually use the MAC address as a validation key or no? Should I be forward with this kind of verification system or should I keep it hidden as a secret? Yes I know hackers and others will find ways of knowing what I am doing, but in reality this is why I am asking.

I know no verification is foolproof, but making it so that its harder to break is something I've always been interested in, and learning how to program is bringing up these questions, because I don't want to assume one thing and find out it's not really accepted in the programming world as a "you shouldn't do that" maneuver.

I am just learning how to program, and I am just making sure I'm not breaking some ethical programmer credo I shouldn't.

share|improve this question
This article on MAC Addresses, UDIDs, and Privacy summarizes your issues pretty well. – Robert Harvey Oct 10 '12 at 17:25
But does it really answer the ethical question... it talks about UDIDs and how Apple isn't meant to be, and Mac Addresses can be spoofed... but does it really does question the ethical question...? – Matt Ridge Oct 10 '12 at 18:10
What is the ethical question? – Robert Harvey Oct 10 '12 at 18:15
As programmers, do we ethically have the right to actually use the MAC Address, or are there stipulations in where it should be acceptable or other places not? – Matt Ridge Oct 10 '12 at 18:25
My Android's MAC address is one thing on bootup, but if I toggle WiFi, it gets set to a different address (but always the same one). 'Tis odd, but makes me think that MAC addresses nowadays aren't as static as they're supposed to be. – Izkata Oct 10 '12 at 21:50
up vote 6 down vote accepted

This article on MAC Addresses, UDIDs, and Privacy covers your issues pretty well.

To summarize:

  1. MAC addresses are not private.
  2. Spoofing a MAC address is difficult enough to make it an adequate safety measure.
  3. You can voluntarily anonymize the MAC address if privacy is a concern.

Since MAC addresses are transmitted with every IP packet that the user sends, whether you keep your checking mechanism secret or not is kind of a moot point.

share|improve this answer
Why wouldn't it be? – Robert Harvey Oct 10 '12 at 18:29
"Spoofing a MAC address is difficult enough to make it an adequate safety measure." -- Are you sure that's true? I thought that spoofing MAC addresses was fairly easy. (I could easily be wrong.) – Keith Thompson Oct 10 '12 at 18:40
@KeithThompson - for the average user, yes, it's reasonably difficult. For a reasonably skilled programmer... not so much. – GlenH7 Oct 10 '12 at 18:41
@GlenH7: It was easy for a reasonably skilled programmer way back in the 90s. Today, pretty much anyone can do it if they want to, because the reasonably skilled programmers have created tools for it. – Mason Wheeler Oct 10 '12 at 18:42
@GlenH7 : The beauty of software.... It only needs one great programmer and its done for everyone. Imagine how easy it is for everyone if it just needs a "reasonably skilled" programmer. – mattnz Oct 10 '12 at 21:52

It depends but this is far more of a business question than an ethics question or a programming question.

If you sell me a 99 cent game and I find out that I have to re-purchase the game (or spend half an hour of my time dealing with tech support) because I needed to swap out my network card, I'll probably experience some minor annoyance. If you sell me a $999 product that I depend on to do my job and I find that I have to re-purchase the product because of that same network card swap, I'm likely to be irate.

Are you going to be able to test all the ways that this sort of a check could go wrong? For example, what happens if you purchase the product on your laptop while you're using your ethernet card and then undock and start using your wireless card? If that causes the application to hiccup, you're going to have an unhappy customer and, hopefully, a call to support. Then throw in users that have one or more VPN connections, virtual machines, etc. and one machine can end up with a rather large number of MAC addresses (I have 7 on my laptop right now). Whether it is worth it to you to test all the possible configurations, to make sure that your application handles the various transitions successfully, etc. and whether you're prepared to deal with the support calls when it doesn't depends heavily on your business model. If my new 99 cent game is flaky, I'm probably not calling support, I'll just leave a bad review. If my server's new $100,000 piece of enterprise software needs a very specific (and well documented) network configuration in order to work correctly, I'll spend hours making sure that we're using exactly the right configuration.

From an ethical standpoint, I would argue that the only requirement of ethical behavior is transparency. In general, if I have a license for 1 copy of a particular software product, I can install that product on one machine at a time but I can freely move it from one machine to another when I upgrade my hardware. If you are going to restrict your software more than this, you should make that clear at the time of purchase so that your customers aren't upset 6 months later when they're setting up their new machine.

share|improve this answer
I thought about these scenarios already, and this is what I came up with. If you have multiple components in a computer have multiple MAC Addresses, the program would record and use it as a validation system. So if you go wirelessly or Wired, or even Bluetooth, it won’t matter, it will be recorded to show you are the owner of said software. If you switch cards, you still have a file on your computer, if it shows and validates the records correctly that you owned the old cards through the other two forms of ID, then the license would be re-activated under the new MAC Address. – Matt Ridge Oct 10 '12 at 19:05
@MattRidge - It is certainly possible to build this sort of validation, it's just a question of how much time it is worth to you, how much piracy it prevents, and how much annoyance it causes to your users. If you are storing this information on a file on the user's computer, though, it's going to prevent 0 piracy because the pirates will simply update the file. – Justin Cave Oct 10 '12 at 19:09
There would be a verification system on a server, to verify the validation of said file. I think honestly that piracy is always a battle that is often lost by better hackers, but in reality it is a war that you either choose to fight or not. – Matt Ridge Oct 10 '12 at 19:29
@MattRidge - Which is why it is much more of a business question than a programming question. Any anti-piracy system will have false positives that incorrectly cause grief for legitimate users. Any anti-piracy system will have false negatives that allow pirates to use the software. Any anti-piracy system has a non-zero cost to develop, test, and support. The business side of the house has to figure out where the break-even points are and whether any particular anti-piracy system is worth implementing given your customers, your product, and your environment. – Justin Cave Oct 10 '12 at 19:40
Which is why I was asking about the ethicy of doing something like that to protect against piracy ultimately. Before I was told that taking someones information for protection was a nono, I wanted to know if it changed at all at specific types or not. – Matt Ridge Oct 10 '12 at 19:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.