Infralution Support

[dcvchicago]

I noticed that the license key is stored in clear text in the the .lic file in the application directory. Does ILS support storing the license key in an encrypted format? If not, can it be done easily within .NET? Where would I look to learn how to do it? Thanks

David Veeneman
FS Components

[Infralution]

Sorry must have missed this post - I know I have already responded via email to your query but just in case anyone else has a similar query.

The license key is already encrypted and the user must have had the key in the first place in order to enter it – so there is not a lot of point hiding it. However you can do this if you really want. You can derive a new class from EncryptedLicenseProvider and override the WriteKeyToFile and ReadKeyFromFile methods.
_________________
Infralution Support

[jsobell]

It seems odd to me that the key is left in plain text in the application folder, as one major method of avoiding piracy is to restrict access to the key required during installation. Yes, it's available in the user's email or on their CD case, but this is generally much more difficult to locate from externally.
Leaving the key in plain text means I can (for example) Google or FTP search for any MySpecialApp.lic files that have been left in public folders, read them in plain text, then type them in after downloading a demo version of MySpecialApp.
If this data is stored encrypted (or even stored in the registry) then this becomes much more complex, particularly for novice users.

I know we could override the class, but why exactly is it stored this way by default?

As a point of reference, many large vendors, in particular Microsoft, will refuse any software that stores its license key in this manner.

Cheers,
Jason

[Infralution]

One reason it is stored this way by default was given above. Another is that many users of software manage to lose their emails and CD cases etc (we regularly get emails from customers who have done this) and storing the license in clear text means they can easily find and reenter their license key.

We can look at adding this an option. I'd be interested to see your reference for Microsofts policy on that.
_________________
Infralution Support

[jsobell]

Hi, thanks for responding so quickly.
The reference is that we develop and supply software software for internal use by Microsoft, and part of their internal deployment process is that it must go through an internal acceptance test, with this being one of a key requirements.

This Google search demonstrates the problem, and Google actively filter out license files and password files wherever possible, yet thousands still get through:
http://www.google.com/search?q=+filetype:lic

Changing the license provider is not actually as simple as you make out, as overriding the WriteKeyToFile has no effect if you use the LicenseInstallForm class.
The form's GetLicenseProvider() is hard coded to return a new EncryptedLicenseProvider(), so the overridden WriteKeyToFile is never called. Would it not make more sense to provide a constructor that either takes the EncryptedLicenseProvider that you want to use, or accepts the Type so that it can instantiate an instance of that object internally?

(quick edit)

The following solves theproblem if you pass the type in:

[Infralution]

[jsobell]

[Infralution]