Paul,
I do the separate demo and registered version thing. The question you have
to ask using this method is "who do you trust"? A user who is going to pay
for the app, who might give it a way, or some anonymous hacker that will
make a free key generator available?
I take the stand that the customer is going to do the right thing. They
did, after all, pay for the app.
The hacker could care less, and the hacking and thrill of producing a key
generator is part of the motivator behind doing it.
I haven't found a registered version of my applications flying around on FTP
sites... That doesn't mean that they don't exist, they certainly could.
However, I don't have any of the overhead of worrying about key generating
when someone registers, or if anyone hacks it coming up with a new
generator.
A simple compile time switch lets me create the demo or registered version
from the same source. So I've found for my applications and for
distribution that doesn't penalize a user when they upgrade to a new device
or get married changing their hotsync name that this is the best approach
for me.
Ed
----- Original Message -----
From: "Paul Taylor" <[EMAIL PROTECTED]>
To: "Palm Developer Forum" <[EMAIL PROTECTED]>
Sent: Saturday, September 16, 2000 4:51 PM
Subject: Better hack protection mechanisms?
> Hi all,
>
> I have just been informed that there's a key generator available for
my
> application and was wondering if there were any better mechanisms out
there
> for registration.
>
> Currently, I'm generating a RegCode based on the Palm User Name and
> using that to generate an unlock key. The user enters in the Unlock key
> that I email to him and presto, it's registered. I could change my
formula
> for generating the key, but that would probably be cracked in, oh, about 5
> minutes. I understand that the unlock key mechanism isn't very safe,
since
> everything needed to crack it is actually included in the application. It
> doesn't take a very skilled hacker to crack.. Or, I wouldn't think it
> would...
>
> Having a separate demo version and registered version seems even more
> unsafe, since the registered version would probably make it up on some ftp
> site within a few days of release.
>
> Is there anything else that can be done?
>
> I know that Aaron Ardiri has done lots of work in this area, and I
> remember reading some time ago that he was going to write up a paper on
how
> to make it more difficult for the hackers. Has he released that anywhere?
> (Possibly privately to other "known" developers?)
>
> Paul
>
>
> --
> For information on using the Palm Developer Forums, or to unsubscribe,
please see http://www.palmos.com/dev/tech/support/forums/
>
--
For information on using the Palm Developer Forums, or to unsubscribe, please see
http://www.palmos.com/dev/tech/support/forums/
