Member Avatar for Saboor880

HI! I have made an desktop application, which i have to install on my client's pc. But I want that, except that particular cleint's pc, no other pc could run it. For this purpose i got a solution to get mac address of that pc and make a check for that. But according to me this solution is not permanent as mac address changes with the NIC.

Now a days people use USB Internet devices(External NICs/Wireless modems) to use internet. When they change their device, obsviously mac address and ip address changes automatically.

I want a solution other than mac address security. Is their any way or alogorithm to make a security check other than mac address security?
Thanks!

  • 3 Contributors
  • 2 Replies
  • 292 Views
  • 17 Hours Discussion Span
  • Latest Post Latest Post by stultuske

Dani AI

Generated

Short answer: don’t rely on MAC alone. MACs can be changed or spoofed and will break if the user swaps NICs or uses USB modems; that makes a MAC-only lock brittle. (howtogeek.com)

A practical, commonly used pattern is: build a hashed “machine fingerprint” from several stable identifiers (SMBIOS/UUID, baseboard serial, BIOS serial, processor id, etc.), issue a signed license file that contains that fingerprint, and have the app verify the signature and the fingerprint at startup. Read those identifiers via platform APIs/WMI on Windows (Win32_ComputerSystemProduct, Win32_BaseBoard, Win32_BIOS, Win32_Processor) and choose a small set that balances stability vs. uniqueness. If the customer can’t be online, implement an offline activation request/response so you can generate a matching signed license file. (learn.microsoft.com)

Example (conceptual) — compute a stable hash, verify signed license, fall back to activation UI:

String[] ids = {UUID, baseboardSN, biosSN, cpuId};
String machineHash = sha256(String.join("|", ids));
if (verifySignature(licenseFile, publicKey) && licenseFile.machineHash.equals(machineHash)) {
  startApp();
} else {
  showActivationDialog();
}

Hardening: sign your JARs and verify integrity, and use bytecode obfuscation to raise the bar against casual patching, but understand limits — client-side controls can be bypassed by a determined attacker and obfuscation only slows them down. Treat these as deterrents, not absolute guarantees. (docs.oracle.com)

Trade-offs: re-issuing keys (as suggested) is workable but costs support time; as warned, a Java-capable user can patch local code. For highest assurance consider server-based entitlement checks or a hardware key/dongle — both increase complexity and cost but reduce local attack surface. For real products, follow a signed-license + periodic server validation workflow and clear support process for legitimate hardware changes. (flexera.com)

Recommended Answers

All 2 Replies

Member Avatar for stultuske

True, that will work, but I wouldn't get too hung up on it.

If it is indeed a local installed desktop application, the user (if he knows some Java) is more than capable of editing the application to remove the restriction from the application.

Spending months of research to implement the perfect security solution which can be deleted in a matter of minutes is not worth the time :)

commented: Agreed. "I put a lock on it." Me? I walked around the end of the fence. +14
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.