Hello pinhasro-ga,
As far as a single unique identifier, for commodity hardware the
answer is no. Some Intel CPUs ship with a unique identifier, but this
is not universal, and can be turned off by the user in the BIOS.
As far as generating a unique identifier, sublime has hit on the
essential problem - hardware changes. My computer is only about 2
years old, and I have replaced the motherboard and a network card,
added a SCSI card, added a soundcard, added a second videocard, added
5 new hard drives and two new opticals, and tripled the RAM. I also
have a removable hard drive bay, so every other time I reboot my
computer (and in fact while it remains booted), my hardware
configuration can change. Any number generated from those variables
would change. Now, while I'm a member of a small minority of computer
users in that regard, regular users are *very* irate when their
software stops working, and they'll be even more pissed off if they
find out that your software *deliberately* stopped working.
Microsoft has tried a scheme in the Windows XP Product Activation
which computes a hash based on what hardware you have, but this has
been cracked (in numerous unique ways) and is a real pain for anyone
whose computer changes. If you are interested, I can try to find
numbers as to how much money Microsoft has spent supporting this
scheme (manned phone lines to let people call up and get a new product
activation code so their computer keeps working).
If I were to write software and needed to protect it from illegal
copying, I would require a serial number such as is common now.
However, rather than a serial number that works forever, on any
machine, and basically just pisses off legitimate users and makes
illegitimate users write it on the CDR they copied the software to, I
would add some checking. Any time your software is run while the user
is net-connected, it would transmit its serial number to your computer
network, which would validate it against a list of known-bad serials
(ones you've seen posted on the net). If the numbers match, the user
would get a message saying that their "serial code has been
invalidated - please contact such-and-such company if you are the
legitimate owner of our product" If they are and someone just stole
their serial, issue a new one and be on your way. The software should
keep track of the date and number of times used, so at least once
every 1000 (or whatever) times the software is used or once a year, it
calls home or asks the user to please connect to the internet. It is
a well-known fact that issuing certificates (such as serial numbers)
with no mechanism to invalidate compromised certs is fundamentally
flawed.
I've strayed a bit from your original question, but I hope this has
been useful. Don't hesitate to ask for a clarification.
-Haversian |
Request for Answer Clarification by
pinhasro-ga
on
15 Dec 2002 07:48 PST
Perhaps I'm not explaining myself clear, so I can't get clear answer.
Our problems is as follows: we produce software that users download to
their PCs to play games. Each user first time receives 30 days free
play. After 30 days the user has to pay for the service. Some people
abuse us, after 30 days they change their user name, and re-activate
their account as new free trial account for next 30 days. And some
nasty people do it 10 times, or even more. This causes us loss of
revenues, and also brings complaints from paid people.
We want to stop people from being able to change their user name when
playing from the same PC. We are not concerned with people changing
HD, or HW, nobody does that to cheat on us. Same with changing PC: how
many time the cheater will go to a different PC to avoid paying. After
few time he will run out of PCs available to him. The way we want to
protect us is to read some unique PC identifier when the player
downloads our software. Then we can associate this identifier with his
user name, and block his access when he will try to access the
application from the same machine but with different user name. Or,
instead of reading unique PC identifier, we may also install
"covertly" some unique number on user's PC, which we can use later to
correlate to his user name. What do think about this?
|
Clarification of Answer by
haversian-ga
on
16 Dec 2002 01:07 PST
In choosing a way to limit abuse of your software, you must also
consider the way it affects legitimate users. While branding each
copy you give out with a digital certificate tied to the user's email
address, credit card number, computer hardware, and MAC address and
checking the validity of the cert against a database on your systems
would be highly effective at stopping abuse, it would be highly
disruptive to legitimate users, who would likely defect. You probably
already are thinking about that, but it never hurts to mention it
again.
Most software (in my experience) uses the Windows Registry to denote
"been there, done that" so a new copy of the trial software cannot be
used. Knowledgeable folk find and delete the registry key, but the
vast majority of folks don't even know they *have* a registry, let
alone can edit it. You could also write a hidden file somewhere on
the user's hard drive that says the same thing. Under Windows 2000 at
least, there's a folder called "Application Data" in the user's
Documents and Settings folder that's already hidden by default, so you
don't even have to hide your file. You could write both and have your
software object if either one is missing.
Ultimately though, all you can do is make it harder; you can't keep
folks from stealing your software. The computer your software is
running on is untrusted, and your software can't even tell if it *is*
a computer. Software exists to run one operating system inside
another, and neither the OS nor the applications know they're not
running on real hardware.
It's not clear what this account is you speak of. Could you elaborate
a bit? Perhaps there is some way there to limit the number of times a
user can install your software.
|
