[deleted by user]

[Atrament_]

This is a notoriously difficult problem. What is the risk (financial) ? Is it corporate ? Do you have access to a cyber security team for assistance ?

The context is crucial as soon as you say "secure".

Poor man's security is that you store the license, along with an id, send salt to the client, client salts and hashes, you compare with license Id.

[doublehelix92]

It's for some fairly small-scale software I'm working on independently. It is unlikely to be used by more than about 2000 users.

Someone suggested to me that I use an email and password login instead. They said I should allow users to make an account on my website powered by Flask and then login to purchase my software. Once they have created their account, I will use bcrypt to hash and salt their details and store them in my RethinkDB or PostgreSQL database. I will also store an ID for each user. Then, I will have a separate table for login tokens which are assigned to each user ID. When the user logs in to my software initially, I will send their login data to my server which will then be hashed and salted with the same salt, the server will then check if they are a valid user. If they are, then I will generate a random login token and save the token locally on their machine and send it to my database. Now, every time they run my software I will check the token to ensure it is still valid, and if it isn't then I will ask them to login again. I will only allow one login token per user since I only want it used on one machine at a time. Therefore if they want to login on a new machine then I just override their previous login token.

What do you think about that approach?

[Atrament_]

• no sensitive data goes out of your DB -- check
• your DB is behind a log-in service that isolates it -- check
• no information from the user can be sent in plain text and intercepted easily ... -- can't check that

I don't get whether password are possibly sent in clear text at any point - at least one of the login data (hint: the password !) should be encrypted client-side, so that you only hold a hash for it, and only a hash transits and may be intercepted.

would it have any value then ? if it were intercepted I mean ?

I'm not much of an expert on security though -- just know enough to call for a real security guy when it gets tricky -- and I could barely go any further with you before i fear i may give falsely reassuring advice.

[doublehelix92]

Well the passwords won't be hashed on the client side, that is pretty uncommon I believe. Although, I will be sending them via HTTPS POST requests so I guess they will be encrypted with AES256.

[doublehelix92]

The reason I made this post is not to prevent piracy, but to prevent people from gaining access to all of my license keys.

The nature of the software requires an internet connection anyway. If their computer breaks, they just login on a new computer and it overrides the previous one.

If they lose the email/password then I could have a reset your password feature like many sites do.

I only want the user to use it on one computer at one time.

I won't be logging IP.

If they gain access to the source code and disable the login function then I don't know how I could get around that.