What serial number licensing solution should I use for a Python application with Fastspring?

EDIT: Can someone explain why this is an "Off Topic"? I think this very clearly follows the principles outlined in the FAQ. Is something missing?

I am building a Windows desktop application in PyQt (python 2.7, PyQt 4.9.5), and I am approaching the release of software for sale. Itโ€™s time for me to add some kind of system for activating software based on licensing / serial number. The software is a business product with a retail price of around $ 250.

I looked at Fastspring and they offer integration with:

  • Aquaticprime
  • CocoaFOB
  • GameShield and Passport Software
  • Yummy Interactive SoftwareShield
  • Soraco Fast License Manager
  • Softwrap
  • Concept SoftwareKey System Software

What are some good features to provide this feature? Some of the things I came across are that none of them seem to provide a python API, so I will need to figure out how to integrate my stuff with my Python code. I never did this, so ease of integration with Python would be a strong factor, as would cost. I donโ€™t feel a strong need to prevent someone from pirating in my software, I just want to keep the honesty of the business so that they buy the right amount of space. The last thing to keep in mind is that in the future I might want to make it a cross platform, and ideally I would not lock myself on just windows.

Thank you for your help.

+4
source share
1 answer

It should be noted that it is relatively easy to decompile and reconstruct Python bytecode and remove any protection that you put into it, so you usually should not spend too much effort and time implementing protection against hacking. You just want to bet enough for people to be honest.

If you are worried that companies are buying the right amount of seats, one of the main protection mechanisms is to use the public key mechanism to digitally sign a message using the private key on your licensing server. The message is just a random string and some unique identification information that restricts the machine to a valid key for (for example, MAC address, etc.) and possibly a timestamp if you want to complete the key. This message and signature is then encoded in a line that your customers put into your program, which verify the license key, verifying that the signature matches the message and the message matches the machine.

There are simpler schemes if you don't care that the user has a key (not so that they have a different key for different machines); you can just use a completely random string for the message.

This scheme is safe if the user does not redo your code. It can be circumvented by reverse engineering the public key in your program using your own public key. It can also be circumvented by selecting information used to identify a computer, for example. MAC address falsification of this data may allow multiple installations to use the same key.

+2
source

All Articles