I have a standalone Java app that has some licensing code that I want to secure, i.e., prevent users from changing my software to circumvent the licensing. What is the best way to do this?
I've looked at obfuscation, but that entails all sorts of problems: reflection, serialization, messed-up stack traces, etc. Perhaps jar signing could be a solution? But how do I verify the jar at runtime? And how do I ensure that the user doesn't change the jar verification code?
You can seal the jar. Pls. see the below links for details
-- http://java.sun.com/docs/books/tutorial/deployment/jar/sealman.html
java.sun.com/developer/JDCTechTips/2001/tt0130.html
Sorry, if your users are savy enough to tamper with your class files, they will remove the signature checking features first thing. I agree with obfuscation, but shouldn't a good obfuscator keep some dictionary to convert an obfuscated stack-trace for you?
This discussion is really old, and really really complicated. Just look at the game industry. Maybe you should consider shipping a guitar with your application?
Combine the two, and you should have good synergies.
This is a legal problem, not a software problem.
You can make it more difficult for the first user to make a copy, but not impossible. And once the determined attacker has broken your security, he can make an unlimited number of copies for the lazy.
If you think it's profitable, prosecute people who make unlicensed copies of your software.
I believe the portion of users who will knowingly steal your software (or, more generally, intellectual property) varies with the type of media, and for most products, is relatively small. If you are selling T-Pain MP3's, theft might destroy your business. Otherwise, adopt the stance of credit card companies, who expect to tolerate some losses due to fraud but still make a profit.
We currently use an obfuscator, which provides reasonable protection against attack. The one we are using right now provides a stack trace tool which will de-obfuscate them when they come out the other end (based upon the log file generated at obfuscation time).
Even with this, there is no real protection against the determined hacker.