please wait
How trial versions are built ?
May 27, 2010 at 11:53am
Hi,
I've a question about trial versions of softwares.
There are some trial softwares for people to try. They're like 30 days limited or using 10 times limited.
My question is , how do they achieve it ?
I mean, they can't keep them in a file , because people can easy change it or delete it.
My guess is that , they keep it in windows registers but , they can also be changed or deleted ( even it's a bit difficult than changing or deleting file)
but still unreliable.
So , how software companies built trial versions , how they can be sure that user will not remove day or usage limitation ?
What method shall be used for it ?
I've a question about trial versions of softwares.
There are some trial softwares for people to try. They're like 30 days limited or using 10 times limited.
My question is , how do they achieve it ?
I mean, they can't keep them in a file , because people can easy change it or delete it.
My guess is that , they keep it in windows registers but , they can also be changed or deleted ( even it's a bit difficult than changing or deleting file)
but still unreliable.
So , how software companies built trial versions , how they can be sure that user will not remove day or usage limitation ?
What method shall be used for it ?
May 27, 2010 at 1:47pm
The single most important fact in security: no code that's executed in the client side is undefeatable.
No matter how complicated you've made your trial verifier, someone determined enough can and probably will break it. The question is, how determined does a hypothetical user need to be to break it.
Store dates as text in a configuration file: undetermined.
Store dates as binary data in the registry: slightly determined.
Store dates as encrypted binary data: determined.
Store dates as checksummed encrypted binary data: very determined.
Obfuscated machine language plus detection of analysis tools: extremely determined.
Require data being processed by a server: unbreakable*.
*Save for breaking into the server room and analyzing the code running on it. By that point it's probably easier and within the user's capabilities to just kidnap a developer and apply a bit of rubber hose cryptanalysis.
No matter how complicated you've made your trial verifier, someone determined enough can and probably will break it. The question is, how determined does a hypothetical user need to be to break it.
Store dates as text in a configuration file: undetermined.
Store dates as binary data in the registry: slightly determined.
Store dates as encrypted binary data: determined.
Store dates as checksummed encrypted binary data: very determined.
Obfuscated machine language plus detection of analysis tools: extremely determined.
Require data being processed by a server: unbreakable*.
*Save for breaking into the server room and analyzing the code running on it. By that point it's probably easier and within the user's capabilities to just kidnap a developer and apply a bit of rubber hose cryptanalysis.
May 27, 2010 at 2:42pm
Not even that last one is unbreakable without leaving one's desk, helios. In fact, it seems easier than the second to last one. What kind of data are we talking about exactly?
EDIT: I see.
-Albatross
EDIT: I see.
-Albatross
Last edited on May 27, 2010 at 3:04pm
May 27, 2010 at 3:01pm| *Save for breaking into the server room and analyzing the code running on it. By that point it's probably easier and within the user's capabilities to just kidnap a developer and apply a bit of rubber hose cryptanalysis. |
Lol.
May 27, 2010 at 4:36pm
I mean refusing to run if there's something like SoftIce loaded. I've seen Acrobat Reader doing it.
May 27, 2010 at 4:42pm
If You deploy an internet-based application , You should go with Server-authentication method...
Else, you could try ADS to , at least, hide your encrypted data^^...
(Never rely on the OSs´ Time to verify the number of days used)...
EDIT: try retrieving the BIOS time instead... It is more annoying to some unexperienced user to change the BIOS time and restart everytiem You need to get the right date, than chaning the OS time with a few clicks)...
Else, you could try ADS to , at least, hide your encrypted data^^...
(Never rely on the OSs´ Time to verify the number of days used)...
EDIT: try retrieving the BIOS time instead... It is more annoying to some unexperienced user to change the BIOS time and restart everytiem You need to get the right date, than chaning the OS time with a few clicks)...
Last edited on May 27, 2010 at 4:44pm
May 28, 2010 at 12:42am
Isn´t that covered by "internet-based"?...
Else you could simply disallow the ping due to access restrictions...
Else you could simply disallow the ping due to access restrictions...
Topic archived. No new replies allowed.