Software Copy Protection (Software based or Hardware based)

[cjsio]

Hi, we are migrating our software from VB6 to .Net
We are revising on our software copy protection. Any advise on using software based or hardware based protection? We have discussed and might prefer on hardware based to reduce the ungeniune license code enquiry and reduce the support cost . Any advice?

[Kasracer]

Hardware based? So you're talking about some sort of dongle? If so, you're going to increase manufacturing costs greatly for something that's very easy to crack.

You, however; have not given any details by what you mean with "software" or "hardware" based protection. We can't really give you advice on your plans unless you give us more information about them.

[cjsio]

Hardware based? So you're talking about some sort of dongle? If so, you're going to increae mnufacturing costs greatly for something that's very easy to crack.

You, however; have not given any details by what you mean with "software" or "hardware" based protection. We can't really give you advice on your plans unless you give us more information about them.

Yes, we are going for dongle (maybe). We are concern about the increase of manufacturing costs. As we were concern about the security it provide too. I don't really understand how easy u mean to crack a dongle. Even it is well implemented its easy to crack? Hope to learn more from you.

We are currently looking around for dongles suppliers, HASP and Sentinal are well known. Of course we've seen quite some fail implementation of dongle that being cracked of emulate.

[Jenner]

Dongles are no harder to crack than software based protection. It won't keep the thieves from posting your software to some torrent site. They'll either remove/bypass the dongle check code from the program or point all such checks to a function that acts as a "virtual" dongle.

Since the most dedicated crackers have links to organized crime in foreign countries, they'll actually buy a copy of your company's software legitimately, dongle and all, crack open the dongle, hook some probes to it to retrieve it's key or whatever so they can crack your program and sell it on the streets of Bangkok for $2 US a copy.

Then again, it all depends on how useful/specialized your program is.

[BillGeek]

I find that the easiest way to protect software is by using some online validation. Each package gets it's own 45 digit key (or whatever) and the users need to activate it online.

Similar to Steam and EA's DLR. (or whatever it's called) It's a real pain in the butt, yes, but it's probably the only way to make sure that no-one gets an illegal copy. (EG: When the user sends the unique key, you also send his HDD serial number, or something of the sort)

[DeanMc]

At the end of the day no software is uncrackable and hardware gives a false sense of security. The thing is if someone wants your application they will get it. My advice is to just have a standard copy protection scheme and don't worry about it so much. Copy protect generally annoys the genuine user if it is too restrictive and still gets cracked by the crackers.

Look at how restrictive the EA game spore was and within a few days it was cracked and available to download!

[xaero1]

As above, dongles don't offer any extra protection but cost a great deal more than a soft key based system. You'll be paying $20-$30 per unit plus will have storage, inventory, mail costs plus impatient customers waiting for the dongle to arrive in the post.

Compare this cost to a soft key system like Nalpeiron and your unit cost could be $1-5.

[astraujums]

At the end of the day no software is uncrackable and hardware gives a false sense of security.

This is not true.

Syncrosoft, part of which is now owned by Steinberg/Yamaha, produces eLicenser USB dongle. It has been used to protect Cubase/Nuendo 4 for its entire lifecycle (~3 years). This is unprecedented for software that is so demanded on the hacker scene.

Syncrosoft/Steinberg protection might not be relevant in the case of the original poster because it can be used to protect programs written in C/C++. However, if there are some DLL's that are written in C/C++ then Syncrosoft solution is worth considering.

I must agree, however, that most hardware solutions (completely) sacrifice security for the ease of use, thus, ending up as a single-button-protect (and single-button-crack) systems.

Atis
(Former employee at Syncrosoft but that does not change the fact that Cubase 4 was never cracked )

[Jenner]

This is not true.

Syncrosoft, part of which is now owned by Steinberg/Yamaha, produces eLicenser USB dongle. It has been used to protect Cubase/Nuendo 4 for its entire lifecycle (~3 years). This is unprecedented for software that is so demanded on the hacker scene.

I wouldn't be patting myself on the back so quickly...

I see some interesting things when I Google "Syncrosoft emulator" as well...

Trust me, NOTHING is uncrackable.

[astraujums]

I wouldn't be patting myself on the back so quickly...

Just try it.
I could bet on, say 100 USD, that it does not work correctly. I would know if there were any working cracks of Cubase 4.

Trust me, NOTHING is uncrackable.

I trust you on this, of course.
However, sometimes (rarely, but it happens) cracking takes so long that it becomes impractical.

Atis

[DeanMc]

Everything is crackable as i have already said. time is not a factor so much as customer experience. The fact is most companies spend well to much on weak software lockdowns that infuriate the end user and get cracked eventually. Sure there are systems like the one mentioned but is it really nessecry. Customers will either buy it download it for free or not use it at all and the only ones that matter are the ones that buy it so don't annoy them with illusions of security that make thier experience a bad one.

[astraujums]

Responding to the original question on the choice between software or hardware protection, here are the issues that you should consider before you decide:

Use (good) software-based protection if:
- all-electronic license delivery is required
- users need to use the software only on one computer
- users are not expected to change critical computer parts often (major source of support calls)
- only protection against simple end-user accomplishable "cracking" (e.g. setting files to read-only etc.) is required

Use (good) hardware-based protection if:
- prevention of piracy is critical
- users need to run the software on several computers
- you can afford to spend some resources for protection
- you have means to deliver the copy-protection device physically

Using bad protection systems (software or hardware) is not reccomended, as it will have all the drawbacks of the copy-protection and only a few if any of the advantages. Good protection gives the legitimate users the feeling of having acquired something of real value -- something that others cannot get for free (in other words -- not being the fools who paid when others have just got it free).

Hope this helps,
Atis

[Kasracer]

Just try it.
I could bet on, say 100 USD, that it does not work correctly. I would know if there were any working cracks of Cubase 4.

If it didn't involve breaking the law I'd easily take that bet. Actually, I bet I can find a pirated version that works better that the commercial version .

I trust you on this, of course.
However, sometimes (rarely, but it happens) cracking takes so long that it becomes impractical.

Cracking never takes long. Look at Macromedia, they developed a system of checksums, encrypted binaries, phoning home, and serial numbers and their software was cracked before it was released.

I have never heard of a system that takes so long that crackers gave up. Typically you either have 1 or few points of weakness which can easily be modified via assembly, or you have many points (hardware dongle comes to mind) where code verifies other things before it does its thing. In this case a simple emulator or pass-through driver works perfectly.

Sure some large, enterprise software may never be bothered with because, honestly, how many people need to crack a $300,000 application and distribute it?

[DeanMc]

I do..

[Kasracer]

Using bad protection systems (software or hardware) is not recommended, as it will have all the drawbacks of the copy-protection and only a few if any of the advantages. Good protection gives the legitimate users the feeling of having acquired something of real value -- something that others cannot get for free (in other words -- not being the fools who paid when others have just got it free).

Tell me, what is a "bad protection system" and what is a "good protection system"? They all have points of weakness allowing them to be easily cracked.

Also, I really hope you were joking about the whole "feeling of having acquired something of real value". What does that even mean? Because you're inconvenienced by entering a serial number or using a dongle you feel like you have something of value? If that's the case then I will strongly disagree with you. I cannot tell you how many people I have met who were incredibly frustrated with QuarkXPress' dongles (especially under OS 9; it was difficult to say the least!) or using 3D Studio Max's licensing server. At my last University we had a license server for 3D Studio Max and for seemingly no reason at all, it would randomly tell us we didn't have any licenses to use Max... in a 3D modeling class! They'd have to restart the server to get it working again.

I think the real point is this: there is no fool-proof protection system and some of the complex / "good" ones are detrimental to the user experience.

I do..

So... you have a need to crack and distribute a $300,000 enterprise application? um... well have fun with that...

[astraujums]

Tell me, what is a "bad protection system" and what is a "good protection system"? They all have points of weakness allowing them to be easily cracked.

Let's face it - copy-protection systems are meant to help developers and not end-users. Therefore, a good protection system is one which allows having as strong protection as desired and is easy to implement for the developers. From systems that match this, the best ones are those that the end-user has least interaction with.

Also, I really hope you were joking about the whole "feeling of having acquired something of real value". What does that even mean? ... I cannot tell you how many people I have met who were incredibly frustrated...

There could be several reasons for legitimate users to be frustrated. Users might be frustrated that they have to buy software -- that's fine. Users might be frustrated if they have bought software and it does not work -- that's not fine and means that the protection system is buggy. Users might be also frustrated if they have bought software and discover that other users are using cracked version for free -- that is not fine and means that the protection system is weak.

The latter aspect was the one I thought of when talking about the feeling of real value.

As I said before -- copy-protection is not for everyone. Be careful to evaluate exactly, what you want to protect yourself against and at what cost. Then choose the system that best matches your criteria (which might mean also skipping copy-protection).

Atis