3 ms·

Would be a real shame if someone used mitmproxy modify the validation request in transit. Looking at one of the provided examples [0] it does not have any menti

Would be a real shame if someone used mitmproxy modify the validation request in transit. Looking at one of the provided examples [0] it does not have any mention of certificate pinning. With all due respect this service seems to alleviate the most simple to implement parts of a licensing scheme while not solving the actually challenging parts. Even combined with a sophisticated obfuscating tool it leaves a lot of holes to be filled by the end user. [0]: https://github.com/keygen-sh/example-cpp-license-validation https://github.com/keygen-sh/example-cpp-license-validation Edit:I guess this is slightly offtopic since the article talks about the offline activation method not the online one.

ezekg 5y ago
You can use request signatures to combat MITM attacks quite easily. Certificate pinning is not really needed. All requests are signed the same way license keys are, so without a crack to change the embedded public key, forging a request is essentially impossible. That particular C++ example does not include signature verification, but there is another example repo [0] for that. [0]: https://github.com/keygen-sh/example-cpp-request-signature-verification https://github.com/keygen-sh/example-cpp-request-signature-v...
- no_time 5y ago
  From a cursory glance that version while better, looks vulnerable to replay attacks since I don't see any mention of timestamps or MAC Of course this requires the attacker to purchase at least one license so its a partial victory :^)
  - ezekg 5y ago
    The response body itself for key requests, such as for license validations, contains a timestamp to prevent replay attacks. You can also send nonces, which will be echoed back. :) But it is worth mentioning -- I am working on improving the request signature header to include more info such as current token and date. Just need to finish some other stuff on the roadmap first.

ezekg 5y ago

You can use request signatures to combat MITM attacks quite easily. Certificate pinning is not really needed. All requests are signed the same way license keys are, so without a crack to change the embedded public key, forging a request is essentially impossible. That particular C++ example does not include signature verification, but there is another example repo [0] for that. [0]: https://github.com/keygen-sh/example-cpp-request-signature-verification https://github.com/keygen-sh/example-cpp-request-signature-v...

no_time 5y ago
From a cursory glance that version while better, looks vulnerable to replay attacks since I don't see any mention of timestamps or MAC Of course this requires the attacker to purchase at least one license so its a partial victory :^)
- ezekg 5y ago
  The response body itself for key requests, such as for license validations, contains a timestamp to prevent replay attacks. You can also send nonces, which will be echoed back. :) But it is worth mentioning -- I am working on improving the request signature header to include more info such as current token and date. Just need to finish some other stuff on the roadmap first.