I’m developing a program in C#.
It connects to the internet to see if this copy is valid.
Currently I’m just sending the licence key and getting a response (0 or 1) if the key is valid.
The problem is that some users just fake the data with some packet capturing tool and replay it.
So the application is very easy to crack. How can I prevent this?
Here is what I essentially want to prevent:
- Network replay attacks
- Authentication “emulators”
It should be impossible to find out what data is sent.
Maybe I should add the current time and then encrypt the packet ?
So it’s always different ?
Attention: Please don’t warn me that it’s easy to crack the application itself by modifying it. I know that. This question is only about the network part.
If you use SSL or HTTPS then you don’t have to worry about users cracking the data packets. This is easy because the libraries already exist and are easy to implement. With C# and IIs for example it is just a matter of installing the certs and changing a few configuration items. (Maybe a recompile with some slight code changes).