Subj : Re: Reg methods
To   : Eddy L O Jansson
From : Scott Adams
Date : Sat Sep 29 2001 05:14 pm

 -=> Quoting Eddy L O Jansson to Scott Adams <=-

 SA>      Disadvantage: Usually takes up alot of space and expense       
 SA> sending out the files (if by mail-disk).

 ELOJ> Pros: You can personalize each copy and tag them as to track any
 ELOJ> "leaks". Simple example: Req. a credit-card to register. Take the
 ELOJ> number, hash (md5/sha) it together with a secret password and
 ELOJ> distribute the hash around the executable. I would advise against
 ELOJ> spreading the actual card#.

        Good point. 

 ELOJ> Distribute on-line and you don't have to worry about expense.

        True.
 
 SA> (#3 or 4 I think).  Nothing to this day could break      it or crack
 SA> it.  It could not even be copied.  You could not      even get a

 ELOJ> Yeah, right.

        I had the modern copiers (3-4) that could crack and
        copy the games back then.  I tried to make backup and
        it was impossible.  Couldn't even get past encryption
        for a simple directory listing.
 
 SA>    Those are the main methods I know of.  There are probably others

 ELOJ> How about "don't use one"?

                heh...then how do you verify reg status?
 
 SA> using CRC values, dates and secret random codes.  Then more that

 ELOJ> Don't bother with CRCs. They should only be used to detect bit-errors
 ELOJ> or possibly other non-cryptographic uses.

        That's the standard opinion on it.  
 
 SA> used all of the above plus 30-50 other steps.

 ELOJ> .. and then it all came down to a single boolean check. How tragic.

        Isn't it.
 
 SA>    So does anyone know of a general scheme that seems to work   
 SA> most often that you don't see crackers for?

 ELOJ> If you use registration-keys, make them sparse. Download the Nero
 ELOJ> keymaker with source and read the included documentation for an
 ELOJ> example. (The idea is to _not_ use all keybits in all versions)

        I've not heard of nero where can it be found?

 ELOJ> The only really effective protection is a client<->server
 ELOJ> authentication scheme, where you control the server.

        Yes.  Most seem to think that or a combinatino of 3-4
        of the various methods.  But anything eventually can
        be cracked so nothing is safe.


        

.... I am here to save your butts. - Bester
--- Fringe BBS
 * Origin: EWOG II - The Fringe - 904-733-1721 (1:112/91)

.