Steamed over DRM - Page 3

Villadelfia · October 7th, 2015, 03:44 AM

Have you considered something like this:

If the software triggers a license revalidation, do not immediately kick the user out, instead warn the user that they have 1 week to get it sorted before it deactivates. However, and here's the part to make sure that fooling around with the system clock doesn't work, during that 1 week grace period require an internet connection to start the program.

This kind of stuff is my day job, so if you want to seriously consider it, feel free to mail me for some implementation help.

Togainu · 05:08 AM

While such a system works relatively well. It does open the system up for an extra point of possible vulnerability. This together with the fact that systems like that have been cracked numerous times (including with major companies like Adobe). I don't think this is a smart functionality to implement. And as Rob stated situations like this are relatively rare, together with the fact that most of the situations can be user anticipated meaning they can request a reset before doing any of such actions. Which in my eyes doesn't warrant an approach that might add vulnerabilities to the system.

Also seeing the new feature in the license menu (unlink license). I think they might actually be working or have implemented a system to de-activate your license before doing major alterations to your system. (haven't tried using the system yet so this is just an assumptions of what it does. Planning to test it out myself later today actually)

update: Seems it doesn't allow for license movement. Just tried it between 2 machines of mine. (So not sure what that feature does)

Villadelfia · October 7th, 2015, 08:15 AM

I know that it's easy to implement it in a way that leads to vulnerability, which is why I offered to help. That wasn't a joke, my day job is implementing network security for a company that you probably know.

Togainu · 09:34 AM

Kind of think you are missing the point I was making. No matter how secure you implement it you are adding another point of entry for attacks. Making the program as a whole more vulnerable by default.

Secondly not everyone plays in areas that have access to internet. Meaning they won't be able to start up the program. Course then you can choose to not allow save options. But that means you need to start making notes outside of Hero Lab and enter them at a later point (if you remember and didn't loose your notes which are very realistic scenarios (which is actually how it currently works meaning the connection solution only solves the issue for some users)).

And again it only triggers with major changes to your machine. Which are in majority of the cases user induced meaning you can request a license reset before doing them

Edit: Also seeing the machine ID changed it can't identify itself as the old system anymore, meaning you run into the same issue as before. If someone gives a full copy of their hero lab to someone else. The week reset period can't check reliably if it used to be a legit system.

Exmortis · October 8th, 2015, 12:55 PM

Just remember that LWD also answers to the product owners, not just us the consumer.

Rob is a middle man being squeezed by the IP owner and the IP leaser.

It is easy to suggest what will be better for us, but remember the owner of the IP has to be kept happy, or we have no IP to lease.

herald7667 · October 9th, 2015, 09:22 AM

So is there a fix for the Windows 10/fast ring problem? I can't seem to move My license as it can't connect to the server and it just locks up the whole program until end task on it. I have an email into support.

ShadowChemosh · October 9th, 2015, 09:34 AM

Quote:

Originally Posted by herald7667

So is there a fix for the Windows 10/fast ring problem? I can't seem to move My license as it can't connect to the server and it just locks up the whole program until end task on it. I have an email into support.

Have you installed the latest version of Hero Lab which is v7.3 as it was suppose to have some Windows 10 fixes.

Villadelfia · October 9th, 2015, 10:21 AM

Quote:

Originally Posted by Togainu

Kind of think you are missing the point I was making. No matter how secure you implement it you are adding another point of entry for attacks. Making the program as a whole more vulnerable by default.

This is true, but it's not as if the current security is flawless, in fact it is quite flawed but I respect lone wolf development and will not release my research on that subject. Suffice it to say that small scale piracy is easy, and would not even require any cracking. Large scale piracy on the other hand would require some cracking, but there are some critical flaws in how a license is validated.

If anyone on the dev team is reading this: I'm working on a PoC for both methods and will mail you when they're complete so that you may fix them.

Quote:

Originally Posted by Togainu

Secondly not everyone plays in areas that have access to internet. Meaning they won't be able to start up the program. Course then you can choose to not allow save options. But that means you need to start making notes outside of Hero Lab and enter them at a later point (if you remember and didn't loose your notes which are very realistic scenarios (which is actually how it currently works meaning the connection solution only solves the issue for some users)).

I think we miscommunicated somewhere, I did not intend my proposal to require a constant internet connection. What I'm intending is this: if the license is valid, hero lab would work exactly as it does now.

However, once it detects a license invalidation, it will phone home and start a week long "trial mode" and require an internet connection from that point until the license becomes valid again.

I can see how this won't work for people that play without internet connection, but for the rest it would provide a nice way to avoid a ruined gaming evening.

As for abuse, this system would obviously invalidate the license for use on any system ID when it gets flagged, this would mean that the original user can no longer update until he contacts lone wolf, and the person he shared it with can only use it once, for one week. Continued abuse would quickly become apparent.

herald7667 · October 9th, 2015, 10:22 AM

Ok, I have now installed the latest version, and when I go to retrieve the license it can't communicate with the server. I have verified that it is white listed.

herald7667 · October 9th, 2015, 11:41 AM

Support got me squared away. Thanks for the help folks!

Villadelfia Member Join Date: Apr 2015 Posts: 30 October 7th, 2015, 08:15 AM	I know that it's easy to implement it in a way that leads to vulnerability, which is why I offered to help. That wasn't a joke, my day job is implementing network security for a company that you probably know.
#23

herald7667 Member Join Date: May 2010 Posts: 36 October 9th, 2015, 09:22 AM	So is there a fix for the Windows 10/fast ring problem? I can't seem to move My license as it can't connect to the server and it just locks up the whole program until end task on it. I have an email into support.
#26