DRM for online functions

[eRe4s3r]

I'm curious eRe4s3r, has there ever been a DRM-system that's been a benefit to the customer and not a restriction? Because you've brought up that DRM should reward the customer for buying from the original source, but I've never heard of a DRM system that was an actual benefit to the customer for buying products from X source. It's usually met with a lot of grief so I'm curious if you have an example of a DRM system done right.

King

Well, I admit currently nobody did a good service DRM system that didn't restrict you from playing the game in an absolutely unacceptable sense. But if you want it in terms of just the basic idea. Kerbal Space Program comes to mind, updates via account requirement, gameplay without account requirement. And the game isn't exactly half-way developed, so who knows what they do with the idea.

Might & Magic Heroes VI comes to mind, they revised the DRM after patches to be 1-time activation and account bound and otherwise buying the game gets you a LOT of game benefits, and not buying it gives you still the basic game, just without all the bells and whistles of online features and avatars management. (But in the campaign, you don't play your own avatar anyway)

If you want to know how not to do it, look at Anno 2070, offline play disables gameplay VITAL functions, unlike in Heroes VI where it only disables EXTRA functions that have absolutely no vital impact on normal gameplay. (like certain weapons that can gain levels over many many plays (online and offline, as long as you have a legit account) and that you can keep through various levels and missions.

[keith.lamothe]

If you want to know how not to do it, look at Anno 2070

Right with you there.  I so want to play that game, but I just can't bring myself to spend $50 on something with that kind of DRM.  Maybe a sale will bring it low enough that I can stomach it

[zespri]

And keith, someone actually did commit the effort to reverse engineer your entire serial algorithm

Come On!!! When Arcen say that they have no DRM they are not kidding. It takes whole 20 minutes or less to "reverse engineer" this. This is nothing to be proud of. This is kind of by design.

[keith.lamothe]

And keith, someone actually did commit the effort to reverse engineer your entire serial algorithm

Come On!!! When Arcen say that they have no DRM they are not kidding. It takes whole 20 minutes or less to "reverse engineer" this. This is nothing to be proud of. This is kind of by design.

I don't think he was saying it was anything to be proud of, just something that had been done

I think this is also an example of why eRe4s3r doesn't like to be snippet-quote-response'd

[zespri]

Using a legitimate leaked serial is not exactly a crack ,p If dev cared he could black-list it internally until he gets bored.

There is a keygen that was created after 3.0 release but still works on 3.27. There are a few black listed serials, but since keygen can generate infinite number of them this is not an issue for a pirate. Really. What would you expect a year after release?

[zespri]

It does suck that pirates can actually hurt other customers by registering their ill-gotten key on steam, but that's the only harm that is done: inability to register a non-steam-bought copy on steam.  If they really wanted it on steam they could buy it there and have zero chance of not being able to use the full steam features.  And even if they do find that their key has already been registered, steam has proven willing to fix it (by unregistering it for the other person) upon being shown proof-of-purchase, though sometimes mixed signals are sent.

This is not my experience. I tried to register AI Wars, but was told (after opening a support ticket) that since the purchase was many months ago they are unwilling to do anything. They indicated that they would help if the actual purchase where within a month or so. Thus, I had to be content with NOT having the game on steam.

[keith.lamothe]

This is not my experience. I tried to register AI Wars, but was told (after opening a support ticket) that since the purchase was many months ago they are unwilling to do anything. They indicated that they would help if the actual purchase where within a month or so. Thus, I had to be content with NOT having the game on steam.

Ah, ok; thanks for letting me know, I had not heard in the past that their willingness there was related to purchase timeframe.

Sorry about the inconvenience there; in a lot of ways lately we've learned to really emphasize to people "if you want it on steam, buy it on steam"   Used to be less important, but the whole cross-registration situation is just a hairier process than we previously thought (in more ways than just this).

[zespri]

Sorry about the inconvenience there; in a lot of ways lately we've learned to really emphasize to people "if you want it on steam, buy it on steam"  

I usually want it much much earlier than it's available on steam.

[eRe4s3r]

Using a legitimate leaked serial is not exactly a crack ,p If dev cared he could black-list it internally until he gets bored.

There is a keygen that was created after 3.0 release but still works on 3.27. There are a few black listed serials, but since keygen can generate infinite number of them this is not an issue for a pirate. Really. What would you expect a year after release?

*breathes in*

There was a HTML/Javascript keygen that was only made in 2011 to begin with that actually created TRULY legit serials. All keygens before just created keys without the added security checks each serial had to pass ( of which I think, 10 were implemented step-by-step over time) and so these serials always got invalided 100% properly while legit serials remained legit.

And I think you pretty much prove my point there anyway, I said it must be a hassle, and hunting down the 1 keygen that actually worked for each new update for DOM3 was a huge hassle for any pirate. Their DRM succeeded by any definition of the word, in fact better than any other DRM I know off. Until development stopped more or less with 3.17 I think.., there was not a SINGLE keygen that produced 100% working serials for the next patch. Only when someone actually completely reversed the algorithm and found the checks the game performed on serials to further weed out keygenned keys that "appear" valid was the game keygenned. It was never cracked. And this javascript keygen only appeared in 2011.

Dominions 3 released in 2006 by the way. So for 5 years their serial check remained a hassle to pirates that wanted to update.

*breathes out*

Also you get -50 points for snippet quoting me out of context. The keygen was extra, a bonus and unneeded they did this specifically to prove a point. The fact that they did this and the keygen to this day still works is what peeves me and why I mentioned it. And you know why? Because if proper effort would have been put into the serial algo there could have been additional checks hidden that were not activated yet but which bought keys all passed, yet keygenned keys would not. And every major update, I would add a new check that would instantly invalidate all previous keygenned keys. That's how serials are done.

Dominions 3 only got really "pwned" when active development died off. At which point the developer likely didn't care anyway.

[TechSY730]

there could have been additional checks hidden that were not activated yet but which bought keys all passed, yet keygenned keys would not. And every major update, I would add a new check that would instantly invalidate all previous keygenned keys. That's how serials are done.

Dominions 3 only got really "pwned" when active development died off. At which point the developer likely didn't care anyway.

That would actually work pretty well, no server connection needed to revalidate (beyond the connection needed to download the patch), does not add a huge amount of logic, new steps that could cause a change in validation are restricted to at most once per update rather than a once every startup.

But you better have planned some special properties all official keys will have ahead of time for this to work, and deliberate not test all of them all at the get-go. If you are trying to retroactively apply this sort of check, there is a pretty decent chance that you might not be able to find a suitable test (or rather, the strictest test mathematically possible without false negatives short of whiteisting every legit key ever made would still let tons of keygenned keys through).
Also, there is the risk of a bug in the implementation of the new checks on the key validator, which would introduce false negatives.
And still, there is the cost of implementing this type of system in the first place, which would require either some nifty math and/or cryptography knowledge, or adapting you key validator process to a existing library that can take care of this for you, for questionable returns.
And even if this is solved for the product, third party services that enforce the "key belongs to one customer" thing (like Steam) would need to implement these sorts of checks too. Plus, if key genners are already genning keys (on a moderate basis at least) that the official keygen server can dish out, then you are already screwed; they have already cracked your algorithm well enough. This is what is happening with AI War. Nothing short of changing your key system on the client, service provider (like Steam), and server (the official key genner) sides can stop that. This would also certainly break existing legitimate keys. (Yea, you could email out to people that this is changing and here is a new key, like they did when you first bought the key, but that is annoying and error prone itself)

So yea, if you design your key system from the ground up for good validation rules, then this is a great system. But trying to apply to existing systems not built on this is fraught with issues.

[zespri]

eRe4s3r, I had big hopes for you, you started so nicely in this thread and now you are talking nonsense. You've disappointed me! (Sorry, I'm just kidding here)

Seriously: the only thing in the last post I agree with is the time line of when the keygen was released. I stand corrected.
The rest of the post.... Let's see.

And I think you pretty much prove my point there anyway, I said it must be a hassle, and hunting down the 1 keygen that actually worked for each new update for DOM3 was a huge hassle for any pirate.

This does not make sense. Once keygen is out there there is no "hunting" involved. You just go and get it.

Only when someone actually completely reversed the algorithm and found the checks the game performed on serials to further weed out keygenned keys that "appear" valid was the game keygenned.

These "further checks" are simply checks for previously banned keys. There is nothing mystical or advanced about them.

It was never cracked. And this javascript keygen only appeared in 2011.

There is no practical difference between cracked and keygenned. If a game is keygenned it's as good as cracked. There is no reason to "crack further" although at this point it would be quite trivial.

Also you get -50 points for snippet quoting me out of context.

Sorry for that it was not intentional. For me it looks like I quoted you in the context of the thread. But then again, sorry I made you feel that way.

he keygen was extra, a bonus and unneeded they did this specifically to prove a point. The fact that they did this and the keygen to this day still works is what peeves me and why I mentioned it.

You keep saying "they". Who? The crackers or the game designers? What point where they proving? Sorry, the meaning of the quote above remained a mystery to me.

Because if proper effort would have been put into the serial algo there could have been additional checks hidden that were not activated yet but which bought keys all passed, yet keygenned keys would not. And every major update, I would add a new check that would instantly invalidate all previous keygenned keys. That's how serials are done.

And this is just pure fiction. Serials are done by simply having a DB of all sold units. They are not generated off of an algo. Adding new check every release does not strike me as a good or workable idea either, effectively you are releasing a game with less protection that you could have otherwise. Also all these extra check has to be designed before the first release anyway, which means that there will be a limited amount of them.

Dominions 3 only got really "pwned" when active development died off. At which point the developer likely didn't care anyway.

Again, no. It's not because development died off. It's because there was no clever extra checks. What you perceive as extra checks is simply checks for banned/leaked serials. Ones a proper keygen is released there is nothing else left to do, and this is not because of lack of care. You simply can't do much because you affect your legitimate customers otherwise.

[eRe4s3r]

There is no practical difference between cracked and keygenned. If a game is keygenned it's as good as cracked. There is no reason to "crack further" although at this point it would be quite trivial.

The difference is a crack is copied over and works, usually just like that, copy over and it works. A keygen you have to go look for again and again if the developer is evil.. You don't seem to remember what I said on page 1 ;p Hassle for pirates EACH PATCH, reward for customers with EACH PATCH

You keep saying "they". Who? The crackers or the game designers? What point where they proving? Sorry, the meaning of the quote above remained a mystery to me.

The crackers, obviously. I was talking about the releases I linked to. Prime example on why you shouldn't quote like you did ;p (and why keith even had to laugh at that ;p)

And this is just pure fiction. Serials are done by simply having a DB of all sold units. They are not generated off of an algo. Adding new check every release does not strike me as a good or workable idea either, effectively you are releasing a game with less protection that you could have otherwise. Also all these extra check has to be designed before the first release anyway, which means that there will be a limited amount of them.

If you are a Indy developer who has no real thought put into serials, then yes. But let me just for giggles, tell you how I'd do serials. And believe me, a cracker would keygen my serial within minutes, that's the point. I want that, free PR.

Firstly, on release there would be only the basic algo check for the serial at game start.

Secondly, bought serials would pass this check, and about 20 other checks I would have planned beforehand that further weed out serials out of that algo. The serial to valid serial rate should be 2500k to 1 or better.

I generate valid serials and those go in a DB I give out to customers.

Thirdly, about 2 weeks after release I would implement the first of those 20 extra checks randomly in a patch, I would also have the patch do a 2nd check for the serial, so only a valid serial would pass the patch installation and even if the patch is keygenned the game would be have to keygenned a-new. That way, a legit serial would install the patch, but a cracker would never know the patch adds a different check than the game. Double protection means both patch and game have to be distributed = Hassle for pirates.

That means patch gets 1 of those 20 new checks, and game gets 1. Now 18 checks are left. Keygenners think there are only 2 extra checks. But if someone has the game and cracks the serial based on his legit patched copy he will not generate valid serials for the patch, only for the game.

I do this little game until its about a year after release, at which point I'd stop messing around with that Repeat for each expansion, of course.

That is the VERY most BASIC serial protection mechanism. And it works. It delays pirates sufficiently. And a "working keygen" would not be working for long.

If you think my method is pure fiction you would be surprised that I am not the first to think of this. But maybe to first to mention it here specifically.

Edit: By the way, my serials would not activate on steam. I am not insane For steam you can do steamworks ownership check, without serial.

Edit 2: By the way.. hehe ^^ There is no huge cost, if you develop a way to generate your serials it takes a good coder maybe an hour to come up with these extra checks, he would just need a proper database with generated serials based on algo without checks stored, and then adds rules that weed out enough serials so that you have about 50k or 100k serials that are valid, it takes longer to compute than to code that.

Edit 3: And by the way, obviously I would not tell that the serial is invalid when it's entered. Even the patch would just patch 1 bit different somehow and create a fatal crash situation with an obscure misleading error message. And this is fool proof, it can *not* fail for legitimate customers, ever.

[keith.lamothe]

And this is just pure fiction. Serials are done by simply having a DB of all sold units. They are not generated off of an algo.

Actually, all ours are generated by an algorithm, and we send a big list of valid keys to each distributor (including our direct site, but never the same serial to more than one distributor) and hold some on the side for reviewers and such.  But if we need more we just crank the algorithm more (not that we've needed to).

And the game uses the same algorithm to see if the "key" part of your proposed serial matches what the algorithm function outputs from that key.  If it was just a big set of literal serials with no mathematical relationship I think we'd have to somehow encode all valid serials into the program or something silly like that, but I could be missing something.

[zespri]

I know, I know. I probably misunderstood eRe4s3r. I thought he was contrasting keys (that can be keygenned) and un-gennable serials

[eRe4s3r]

And since that is the case, you could easily develop a set of extra rules for the algo generated serials, by generating a database of maybe 20gb of serials the algo generates, then applying advanced math filters to it until you find a volume you like (500k or something). It would be a KISS system for making fool proof serials with some degree of keygen resistance (obviously not the algo itself). The more effort you would put into the your rules the more stages of possible security the serial has.

And you could still call it "no drm" by the way. ;p

might be worth to think about that for your next AI War Expansion

Edit. With keygen resistance I mean that you could invalidate previously valid key-genned serials. You could even send a batch of valid serials to steam, it doesn't really matter in this case. If all you want to do is curb keygens this simple system would already solve my main issue with the current way serials workin AVWW/AI WAR/TIDALIS