How do desktop applications implement monthly/yearly subscriptions securely?

Low-Effort/AI content is auto-removed. I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

Don't try to win the piracy war. You won't, and you'll mostly punish the people who actually paid. The boring setup is usually best: Stripe/Paddle owns the subscription state your server has one entitlement endpoint: can this account use the app right now? desktop app gets a short-lived signed token after login refresh that token on launch / periodically allow a small grace window for bad wifi, travel, etc. Do not rely on the local clock. Someone will set their date back before the coffee gets cold. For Python desktop apps, assume anything shipped to the client can be inspected or patched. Keep the valuable checks server-side, sign responses, and make casual abuse annoying rather than impossible. Also log device/session counts so you can spot obvious sharing without building a DRM cathedral.

With that said, do not ever listen to the people that try to claim that piracy is some form of guerrilla marketing and that it helps the devs. I have had a few software that was doing really well until the cracked copy came out. In every instance the cracked copy becoming available cut sales down by 80-90%. Piracy does cost developers a huge amount. The timing was exact and the drop was undeniable. I know this is hotly contested but my first hand data corroborates this. It may be true for some markets but is far from my (15 year) experience as a small self published indie dev

i agree, it's just a client to your api for entitlement/auth... web apps are open source and may as well consider your desktop open source too bc people will do whatever they want with it. so yep just hit your api and verify session/license/etc... if you have plan specific data that gets persisted to web client or desktop app, consider that a gift bc people will use it after they cancel their sub...

Yep. The annoying bit is that “plan data” often becomes the actual product by accident. If a cancelled user can keep the useful exported/cacheable thing forever, the subscription is basically just a downloader with invoices attached. Fine for some products, fatal for others. Worth deciding that explicitly instead of discovering it after churn starts looking weird.

I have built subscription entitlement for mobile apps and the shape is the same on desktop. Do not build licensing yourself. You want a payment provider that owns the subscription state, then one endpoint of your own that answers a single question, is this user entitled right now. Stripe works fine. Paddle is worth a look because it acts as merchant of record and handles VAT for you, which becomes a real headache the first time you sell into the EU. On the client, keep a short lived signed token with an expiry of a few days and refresh it on launch. Do not trust the local clock on its own, someone will set their date back within about four minutes of installing. Store the last successful check and allow a grace period so a paying user on a plane or bad wifi is not locked out. That grace window is the part your real customers actually feel, and getting it wrong annoys the people who paid rather than the people who did not. On piracy I would spend almost nothing. Anything running on someone else's machine can be cracked, and the effort people spend cracking you scales with how badly they want your product. At this stage nobody wants it that badly. What will actually cost you revenue this year is failed card payments and silent churn. Make sure a declined card triggers an email and keeps access for a few days instead of cutting off instantly, that single decision is worth more than any anti piracy work.

Don't worry about the piracy; some basic protections so Andy with ChatGPT has to spend more than 30 minutes, will be enough. If someone is determined, there is no way to protect yourself. Depending on how the app is structured, it should connect to the server to validate time and sub status

If possible, have some of the work done on your server. It doesn't need to be anything compute heavy but it must be a necessary part of the application flow. That way you force a crack maker to emulate or setup their own server, that makes it take more work for them and more likely to be flagged by a virus scanner. You'll never create an uncrackable login system so make it prevent the least skilled hackers and rely on your server side stuff for the last line of protection. My main desktop application is called Domain Hunter Gatherer, I accepted over 10 years ago that I wasn't going to stop the crackers so I have separate whois server lists for genuine and cracked users. I found a tell in the way the cracked copies log in and rather than patching it, just use it to serve the inferior whois server list. The effect of the above is that the cracked copy users are not finding the best domains, the paying customers get that. There are domains on many TLDs, for example, that the cracked copy won't detect. You'll never stop the pirates, if MS and Adobe cannot then you definitely cannot. One thing to take into account is the dying trade in software, people buy software far less today than before, people tend to prefer platform agnostic web services or **shudder** phone apps.

Personally I would use a hybrid approach where I would validate the subscription with a server every few days, then locally cache and encrypted license and lock the app if it can't be renewed after a grace period. It wont be uncrackable but it is user friendly and practically useful.

这条评论已被删除。