5 ms·
I think it's odd to offer a service like this with no protection against cracking. I mean, sure, I licence one of my own products with a RSAPSS signature on an
by regecks 10y ago
I think it's odd to offer a service like this with no protection against cracking.
I mean, sure, I licence one of my own products with a RSAPSS signature on an environmental constraint .. but if somebody went to the effort they could just flip a single instruction to bypass it. However, I am pretty sure nobody in my target market will bother.
However, I don't think that would hold with something like this. What stops people releasing a bunch of generic bypass/crack tools against your client SDKs?
- ezekg 10y agoTo validate a license key requires an active internet connection. This is for online/web-based apps, with an emphasis on JavaScript apps built on Node, Electron, etc. Licenses are validated by making an authenticated GET request to something like https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/validate https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/vali.... Keygen isn't meant to be used for offline apps, as license validation requires an authenticated API request.
- ago 10y agoDid you reply to the right person? Your reply does not seem to address anything that was said.
- ezekg 10y agoYes. What prevents cracking is the fact that license keys can only be created if you are either an authenticated user of the account or authenticated with a product API token. In order to create a license crack, you would have to obtain a valid API key for that specific account. Everything with the API is done over the wire, meaning there are no public/private keys within your app to crack.
- deleted 10y ago[deleted]
- wyday 10y agoI don't think you actually understand cracking if you're claiming your protection is uncrackable. You're certainly not the first licensing company to sell that lie, if that is what you're claiming. I can explain why what you just said is easily crackable if you'd like. Spoiler alert: nothing can stop cracking (but that's not the point of licensing): https://wyday.com/limelm/features/why/ https://wyday.com/limelm/features/why/ But I'll just give you the benefit of the doubt and say you didn't actually understand the question. (Also, I'm certain I'll be downvoted for commenting on a competitor's product, but licensing companies that lie to customers is a particular pet peeve of mine).
- NKCSS 10y agoWhat Ubisoft did a few years ago with Settlers VII was to put required pieces of code in the DRM; e.g. without an internet connection, the software would not function at all; it took over a year and a lot of hard work before they found a way to write their own server to serve up the required bits, and it was just for that game, not a general solution.
- Nullabillity 10y agoThen again, the servers were so poor that, for a long time, the game basically wouldn't function with a connection either.
- NKCSS 10y agoTrue :) It was also very badly programmed, making your PC die in agony when you'd play it, even if you had the highest end stuff on the market. Still a very fun game though.
- badlogic 10y agoHey! We've used limelm in our (now defunt product). Everything was a pleasure to use, both the client libs and the web frontend! That said, we obviously had to camouflage calls to the client lib and apply a few other tricks to make mocking out the calls harder. Great product!
- fla 10y agoHe means that if it's easy to patch the if(licence_valid) then the rest doesn't really matter.
- fla 10y agoHe means that if it's easy to patch the if(licence_valid) then the rest doesn't really matter.
- officialchicken 10y agoWould it integrate with my REST API? I'm already using JWT's in authentication headers... what, if any, changes to my existing login would be required?
- ezekg 10y agoYes, you can integrate Keygen using your own user authentication system. You would do so by associating user-less licenses with your app's user models. Instead of using Keygen to manage your users, you would only use it to manage licenses.
- jpalomaki 10y agoNo matter what you invent, somebody will anyways crack it. As you increase the complexity, you risk introducing some problems for the paying customers. Even if the system is relatively easy to crack, it can still serve a purpose. People can't just ignore the license restrictions, they actually need to acknowledge the restrictions and then do some active work to circumvent those.
- amelius 10y agoBut the point is that with a centralized protection scheme, cracking will potentially become very simple for the end-user.