From: wangw@iti.gov.sg (Wang Wei Jun (CC))
Subject: Re: Software Copyright protection devices
Organization: Information Technology Institute, National Computer Board, Singapore.
Date: Fri, 4 Sep 1992 00:40:55 GMT

Sorry for mistakenly sending out an included article without any comments.
Please accept my apology.
Here is the comments I intended to send.
----------------------------------------------------------------------------

In article <1992Sep2.180717.14061@hou.amoco.com> jim@n5ial.chi.il.us writes:
>
>>I am looking for information about designing software copyright protection 
>>devices. As I understand, there are two type of protection:
>
>>  1. A hardware device that connects to host's parallal port and
>>     do a challenge-response from time to time
>
>don't use this --- you'll find you have lots of hostile users, if you even
>manage to GET any users to buy the blasted thing (I won't be one of them).
>I believe this was largely abandoned for this very reason quite some time
>ago.
>

The device I suggested will be completely "hidden" from end users. They 
don't need to know this device exists. The primary reason for copyright
protection device is to protect your hard work. You may spend thousands of
dollars in developing a software. What will you feel when you see peoples 
are using pirated copy instead of buying from you? The fundamental thing
is software need to be protected: either by law or by such devices if 
some people don't abide law. You can always enhance the design to make
the protection device transparent to the user and more user friendly.


>>  2. For networked workstation, the protection software constantly
>>     broadcast a signature to the network and try to detect the
>>     same signature.
>
>you really don't trust your users at all, do you?  well, in that case, do
>you honestly expect them to trust *YOU*?  personally, I demand that a
>vendor trust me to some degree, and if they don't, and someone else offers
>the same type/quality product, guess what.....  by forcing users to contend
>with the hassles you plan to cause them, just to prevent them from pirating
>your work, you not only alienate them because of the major hassle your
>software is (or can be) for them to use, but you also alienate them because
>you are directly implying that w/o that protection, they would steal your
>software.

As you said, trust has some degree. When designing a security system, can
you trust everybody? You must assume that you are in a hostile environment,
right? Do you expect your system adminstrator to trust you so much and give
you the superuser privelige? 
Again, about the "hassle" you mentioned: it's just a technical problem. You 
can always enhance the device so that it's tranparent to the legal user.
There is no reason to take care of those users who don't care about other's
work and using an illegal copy.

>people who want to pirate your software are going to find ways to do it
>with or without your copy protection schemes.  people who are honest,

If your device is secure enough, the effort to break the system is not
worth it. Do you think people can break DES or RSA easily now?
Actually my intention was to start a technical discussion on how to design
a secure device while let it be user friendly (transparent)?

>   --jim
>
>\input std_disclaimer                     % 73 DE N5IAL (/9)
>------------------------------------------------------------------------------
>"[...] the plural of `mongoose' ought to be `polygoose'." [Jargon file 2.9.10]
>
>INTERNET:  jim@n5ial.chi.il.us  |  grahj@gagme.chi.il.us  |  j.graham@ieee.org
>ICBM:  41.70N 87.63W            UUCP:  gagme!n5ial!jim@clout.chi.il.us
>AMATEUR RADIO:  n5ial@n9hsi (Chicago.IL.US.Earth)
>------------------------------------------------------------------------------


----------------------------------------------------------------------
|Weijun  Wang	Tel: +65-7720581	Fax: +65-7773043             |	
|E-mail:	WANGW@ITI.GOV.SG	WEIJUN@ITIVAX.BITNET 	     |
|Post:		ITI, NCB, 71 Science Park Dr., Singapore 0511	     |
----------------------------------------------------------------------
Xref: sparky alt.security:4251 comp.security.misc:1153