Licensing system for 3.0

[Rodolfo]

http://rodolfoberrios.com/post/37122201608/a-system-to-stop-being-nulled what you think?

 

[noerman]

Interesting, I have some comment but later.

 

[illspirit]

I don't know how it all works, but wouldn't they just be able to remove the code that sends information to your server and you wouldn't know that an illegal version is out in the wild?

 

[noerman]

Software developers have a real problem dealing with this because they often base their protection system in obfuscation and that in the long term can be always broken.

Does chevereto will be encrypted? As you know any encryption with the proper tools can be decrypted.

The system is based on the combination of public and private hashes that makes impossible to make legal an illegal installation.

I have seen some IM (Internet Marketing) pc based software doing this, but all can be fail since some callback server can fooled with the fake master callback server. I don't know but someone create it and I did evaluate it.

Basically each unique download of your software must be associated with a encrypted user id and a unique user hash. The user id must be encrypted because it can be known by a simple _GET request like targetwebsite.com?uid so you encrypt it to ensure the privacy of your clients. In the other hand, the unique user hash is a random generated string that can’t be retrieved by a request to the target website (this is the private part). This means that each user id is associated to an unique user hash in the delivered file to your client and the only persons with access to that information are your client and you.

Do you want to track which sites where chevereto installed, or just log it. With above you may just log it and someone can still able to install it on unlimited sites. Or someone and his friends able to use single license on multiple sites.

Just maybe what you missing is a license owner need to submit sites that he own to your server and allowed to be installed, so when installation happen it check (callback) to server to check if the site allowed to install or not.

And maybe some module or classes located within your server, so it need to call the server whenever nee it (maybe for admin side)

And someone can still copied a fresh installed chevereto and direct install it or clone it without using proper installation.

To be the truth I know your method already, although not similar. I did encrypt the agent (on client side) but the agent is locked by ip or site. And it keep callback every few minutes since it fetch something on my server (I provide rss services before). Encrypt or not it doest not matter since it locked by IP and time limitation to parse the rrs data that I provide.

Maybe I don't really know what I write now since I haven't sleep for more than 24 hours, I will re-read later.

 

[Rodolfo]

The method is not reversible. This means that pirates can't fool a installation to make it look legal. The system is not about making automatic calls to my server, is about put a unique footprint.

The current system in Chevereto is very simple and easy to fool, the new system can't be fooled because if you remove the keys, touch them, or do any alteration the installation will be labeled as illegal. The only way to mark an installation as legal is by not replacing the hashes, which only can be known if you have the complete zip package. You can't know the keys of an already running installation and that is the point of this... They can't use keys from someone elses.

So, if they keep valid keys I will notice because a lot of sites will be associated to the same user and then I just ban him.