3 ms·

> In principle, it’s all pretty straightforward. Of course, the devil’s in the details. I was quite surprised how much work was involved in getting it all worki

by ezekg 8y ago

> In principle, it’s all pretty straightforward. Of course, the devil’s in the details. I was quite surprised how much work was involved in getting it all working. Probably 3–4 months all up. And that's why I built https://keygen.sh https://keygen.sh, for those that would rather not spend months building a licensing server in-house. I did this one too many times. :)

userbinator 8y ago
And that's why I built https://keygen.sh https://keygen.sh, for those that would rather not spend months building a licensing server in-house. For a second, I thought you were the owner of the .us site, reincarnated it under a different domain, and trying to imply that crackers would create a keygen for your software anyway. But speaking as someone from the other side ;-) any centralised software protection is going to be dead-easy to crack since the checks and ways it makes them are going to be nearly the same between all apps that use it. FlexLM is an existing example of this.
- ezekg 8y ago
  I agree that all software protection is able to be cracked, but I wouldn't say it's "dead-easy" just because it's centralized. And actually, Keygen is a little bit more unique in that case, because I don't supply any client libraries, and you can also put Keygen behind your own domain (similar to how you would put Stripe behind your own domain). So every piece of software is going to implement things differently. In addition, you can implement public key signature verification to prevent MITM attacks (each account gets their own 2048-bit RSA pub/priv keys). In the end, the cracker will likely need to spend some time figuring out how your unique piece of software utilizes Keygen, and that will deter the majority. But like I alluded to, in the end, all software is crackable. There are certainly those who won't stop at the roadblocks. But there's not a lot I can do in that case, especially just being an API. It's more down to implementation. ;)

by ezekg 8y ago

userbinator 8y ago

And that's why I built https://keygen.sh https://keygen.sh, for those that would rather not spend months building a licensing server in-house. For a second, I thought you were the owner of the .us site, reincarnated it under a different domain, and trying to imply that crackers would create a keygen for your software anyway. But speaking as someone from the other side ;-) any centralised software protection is going to be dead-easy to crack since the checks and ways it makes them are going to be nearly the same between all apps that use it. FlexLM is an existing example of this.

ezekg 8y ago
I agree that all software protection is able to be cracked, but I wouldn't say it's "dead-easy" just because it's centralized. And actually, Keygen is a little bit more unique in that case, because I don't supply any client libraries, and you can also put Keygen behind your own domain (similar to how you would put Stripe behind your own domain). So every piece of software is going to implement things differently. In addition, you can implement public key signature verification to prevent MITM attacks (each account gets their own 2048-bit RSA pub/priv keys). In the end, the cracker will likely need to spend some time figuring out how your unique piece of software utilizes Keygen, and that will deter the majority. But like I alluded to, in the end, all software is crackable. There are certainly those who won't stop at the roadblocks. But there's not a lot I can do in that case, especially just being an API. It's more down to implementation. ;)