2 ms·

To validate a license key requires an active internet connection. This is for online/web-based apps, with an emphasis on JavaScript apps built on Node, Electron

by ezekg 10y ago

To validate a license key requires an active internet connection. This is for online/web-based apps, with an emphasis on JavaScript apps built on Node, Electron, etc. Licenses are validated by making an authenticated GET request to something like https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/validate https://evilcorp.keygen.sh/v1/licenses/3qMEarbK/actions/vali.... Keygen isn't meant to be used for offline apps, as license validation requires an authenticated API request.

ago 10y ago
Did you reply to the right person? Your reply does not seem to address anything that was said.
- ezekg 10y ago
  Yes. What prevents cracking is the fact that license keys can only be created if you are either an authenticated user of the account or authenticated with a product API token. In order to create a license crack, you would have to obtain a valid API key for that specific account. Everything with the API is done over the wire, meaning there are no public/private keys within your app to crack.
  - deleted 10y ago
    [deleted]
  - wyday 10y ago
    I don't think you actually understand cracking if you're claiming your protection is uncrackable. You're certainly not the first licensing company to sell that lie, if that is what you're claiming. I can explain why what you just said is easily crackable if you'd like. Spoiler alert: nothing can stop cracking (but that's not the point of licensing): https://wyday.com/limelm/features/why/ https://wyday.com/limelm/features/why/ But I'll just give you the benefit of the doubt and say you didn't actually understand the question. (Also, I'm certain I'll be downvoted for commenting on a competitor's product, but licensing companies that lie to customers is a particular pet peeve of mine).
    - NKCSS 10y ago
      What Ubisoft did a few years ago with Settlers VII was to put required pieces of code in the DRM; e.g. without an internet connection, the software would not function at all; it took over a year and a lot of hard work before they found a way to write their own server to serve up the required bits, and it was just for that game, not a general solution.
      - Nullabillity 10y ago
        Then again, the servers were so poor that, for a long time, the game basically wouldn't function with a connection either.
        NKCSS 10y ago
        True :) It was also very badly programmed, making your PC die in agony when you'd play it, even if you had the highest end stuff on the market. Still a very fun game though.
    - badlogic 10y ago
      Hey! We've used limelm in our (now defunt product). Everything was a pleasure to use, both the client libs and the web frontend! That said, we obviously had to camouflage calls to the client lib and apply a few other tricks to make mocking out the calls harder. Great product!
    - ryanlol 10y ago
      Based on reading his posts here (site doesn't work), his product seems to be something you'd run on the server rather than on the customers side. Sounds like it does licensing for web applications, not for software that you download to your computer. Doesn't sound very useful.
    - KaiserPro 10y ago
      a previous company I worked for spent many pound coins on using metafortress to make our softeare exceptionally difficult to crack. It went from 5 minutes in a hex editor to being a rather involved job. So it stopped it for a while. Then people realised that instead of cracking licensed program, it was much more simple to crack the license server. (this also made detection much harder.) It also had the advantage of allowing rafts of other software not made by us work as well.
  - fla 10y ago
    He means that if it's easy to patch the if(licence_valid) then the rest doesn't really matter.
  - fla 10y ago
    He means that if it's easy to patch the if(licence_valid) then the rest doesn't really matter.
officialchicken 10y ago
Would it integrate with my REST API? I'm already using JWT's in authentication headers... what, if any, changes to my existing login would be required?
- ezekg 10y ago
  Yes, you can integrate Keygen using your own user authentication system. You would do so by associating user-less licenses with your app's user models. Instead of using Keygen to manage your users, you would only use it to manage licenses.

by ezekg 10y ago

ago 10y ago

Did you reply to the right person? Your reply does not seem to address anything that was said.

ezekg 10y ago
Yes. What prevents cracking is the fact that license keys can only be created if you are either an authenticated user of the account or authenticated with a product API token. In order to create a license crack, you would have to obtain a valid API key for that specific account. Everything with the API is done over the wire, meaning there are no public/private keys within your app to crack.
- deleted 10y ago
  [deleted]
- wyday 10y ago
  I don't think you actually understand cracking if you're claiming your protection is uncrackable. You're certainly not the first licensing company to sell that lie, if that is what you're claiming. I can explain why what you just said is easily crackable if you'd like. Spoiler alert: nothing can stop cracking (but that's not the point of licensing): https://wyday.com/limelm/features/why/ https://wyday.com/limelm/features/why/ But I'll just give you the benefit of the doubt and say you didn't actually understand the question. (Also, I'm certain I'll be downvoted for commenting on a competitor's product, but licensing companies that lie to customers is a particular pet peeve of mine).
  - NKCSS 10y ago
    What Ubisoft did a few years ago with Settlers VII was to put required pieces of code in the DRM; e.g. without an internet connection, the software would not function at all; it took over a year and a lot of hard work before they found a way to write their own server to serve up the required bits, and it was just for that game, not a general solution.
    - Nullabillity 10y ago
      Then again, the servers were so poor that, for a long time, the game basically wouldn't function with a connection either.
      - NKCSS 10y ago
        True :) It was also very badly programmed, making your PC die in agony when you'd play it, even if you had the highest end stuff on the market. Still a very fun game though.
  - badlogic 10y ago
    Hey! We've used limelm in our (now defunt product). Everything was a pleasure to use, both the client libs and the web frontend! That said, we obviously had to camouflage calls to the client lib and apply a few other tricks to make mocking out the calls harder. Great product!
  - ryanlol 10y ago
    Based on reading his posts here (site doesn't work), his product seems to be something you'd run on the server rather than on the customers side. Sounds like it does licensing for web applications, not for software that you download to your computer. Doesn't sound very useful.
  - KaiserPro 10y ago
    a previous company I worked for spent many pound coins on using metafortress to make our softeare exceptionally difficult to crack. It went from 5 minutes in a hex editor to being a rather involved job. So it stopped it for a while. Then people realised that instead of cracking licensed program, it was much more simple to crack the license server. (this also made detection much harder.) It also had the advantage of allowing rafts of other software not made by us work as well.
- fla 10y ago
  He means that if it's easy to patch the if(licence_valid) then the rest doesn't really matter.
- fla 10y ago
  He means that if it's easy to patch the if(licence_valid) then the rest doesn't really matter.

officialchicken 10y ago

Would it integrate with my REST API? I'm already using JWT's in authentication headers... what, if any, changes to my existing login would be required?

ezekg 10y ago
Yes, you can integrate Keygen using your own user authentication system. You would do so by associating user-less licenses with your app's user models. Instead of using Keygen to manage your users, you would only use it to manage licenses.