Anti-piracy Protection Options/Help

Hi everyone,

I am hoping to do a little brainstorming regarding anti-piracy options for an upcoming game I will be releasing in several months. I've never worried too much about piracy before, despite having had my games pirated, because my previous games have all been released on CD, and I don't believe in inconveniencing customers. This game, however, will be downloadable, and so I feel an obligation to put SOME kind protection in it.

The game will feature a "free to play" model with purchasable premium content. What I am trying to determine now is the best way to handle said content. I am hoping to achieve a good balance between piracy protection and ease-of-use. I have come up with three options, ranging from full protection to none, but I am not thrilled with them. So, I'm looking for additional input and ideas.

The options I have so far are:

1. ONLINE VERIFICATION - Customers must register an online account to purchase content. When content is purchased, that content is "activated" on that user account. Every time the player runs the game with installed premium content, the game connects to a server which verifies whether the account is active and has purchased the content.

PROS:
- The most secure method--of course the EXE itself will be vulnerable, but this is the case with all installable games.

CONS:
- Inconvenience to players, as they will need an active internet connection to play the game and need to keep an online account
- I will also have to keep up with pirated copies of the game to continually "ban" accounts on the server.


2. ONE-TIME VERIFICATION - Similar to Option 1, except that the game only connects to the server once when new content is installed. This method is obviously used often for games and applications.

PROS:
- Still reasonably secure
- No constant internet connection needed

CONS:
- Players still need online accounts
- I will still have to keep up with pirated copies of the game to continually "ban" serial numbers.
- Once premium content is installed, it will be playable on that PC, even if I later find out it has been pirated, so some pirated copies will seep through


3. NO ANTI-PIRACY - I give up on worrying about piracy and trust that there will be enough honest customers to earn a profit on the game. When players buy premium content, they can instantly download an installer that installs the content and run it any time.

PROS:
- Extremely easy for customers to use
- No internet connection needed
- Automated--I don't need to keep up with pirated content

CONS:
- Easy to pirate--just share the installer!


My ideal choice would be to somehow prevent "casual pirates" with little technical knowledge from sharing installable EXEs while also not inconveniencing legitimate customers too much by requiring an internet connection. Perhaps I could have a series of valid serial numbers and continually update the main program EXE to block pirated ones? I'm not sure how secure this would be, though, since users would never HAVE to update the main program.

So I come to you, the community, to come up with a better option! Any ideas?

Two last things: first, note that this is a project from someone who already has multiple commercially-published games, so please no sarcastic comments about anti-piracy not being an issue unless the game is worth pirating. Second, please don't turn this into a debate about whether or not games should use DRM or protection, since that's a discussion for another thread. :)

Thanks in advance for your time and help! :D

Personally, I'd go with 1;

Users will be required to use a serial number, which they only type in once at the installation, and every time the game boots up, the serial number will be varified online. Serial number valid? Game continue. Serial number invalid? Game closes. Also, every time a serial number is being verified, the data+time and IP address should be logged.

All you'll need is a database with a crapton of serial numbers, and software that will keep track of all the serial numbers and logs. This way, you'll be able to find out if a single serial number is being used multiple times, simultaneously, over different IPs. And if it is, you can simply delete it from the database! Making the serial invalid instantly.

No accounts needed. You can have people purchase the game online with their Paypal account. Which is linked to an email address!
No software updates needed when a serial/user is being removed.
Yes, an active internet connection is required. But who nowadays isn't online 24/7?

The biggest downside is the fact that if the serial number database can't be accessed (host is down, hacked, errors, etc...), users won't be able to play. :(


Anyway, that's my input. ;)

Quote:

---

Second, please don't turn this into a debate about whether or not games should use DRM or protection, since that's a discussion for another thread.

---

How can I possibly have an opinion what you should chose, without talking about DRM moethods in general.

By adding online activation, or one time verification, you punish your legal users who have paid to play the game, and the game will still be just as easy to crack anyway.

There's a good reason that many big indie productions (big as in World of Goo, Osmos, Eufloria, and so on) are DRM free, and also make a point out of it at the website. Thanks to Saira being DRM free I got it included in a DRM-free bundle that boosted the sales a lot, and I didn't miss out the potential customers who think like me and don't buy DRM'ed products (I know plenty of people who think like me there). A company should not authorize if I can play a game I have paid for. The fact that companies can go bankrupt or the activation servers can go down means that there's always a chance the users will have to use crack the game just to play it when they want to, or even at all. If people get the option to either pirate the product, or purchase it knowing that in the future they might have to do something illegal to run it, guess which choice that makes most sense.

Offline serials are OK, because you can just keep the serial and can install the product whenever you want without having to be online. DRM however have a bad reputation, it signals you want to stop piracy more than that you care for your legal customers - and it doesn't work. If people can crack Spore and 3D Studio Max, your game will also be avaliable on pirate bay with a simple crack.

Whatever you do, don't go for #1, unless you want to get the same type of criciticism as Assassins Creed 2 got. Even most "big" companies does not dare to try this solution. #2 is acceptable and a solution many companies chose, though you will miss out many potential customers (such as myself).

Thanks both of you for your fast and helpful input!

No worries, Nifflas--I'm pretty sure I'll sooner go completely free of any kind of protection than go with option 1. I made a promise to my customer base several years ago that I would never include any kind of DRM that inconveniences them. I agree with you that it punishes customers.

Right now, I'm leaning toward going with a basic serial number tied to a person's name. It's not too protective, but it will scare off some of the more casual pirates. I envision it working as follows:

1. Customer buys content (through Paypal) and gets access to the install EXE, along with a custom-generated serial number, which is a combination of a random key (chosen from a list on a server) and the customer's full name.

2. When the customer installs the content, s/he must enter the name used to purchase the content into the installer, along with the serial that s/he received. The installer derives the original key by removing the customer's name from the serial behind-the-scenes and compares it against a list of valid numbers. If it's valid, the content installs.

The downside is that customers can still share valid serials with one another, but at least I would be able to determine the name of the person who pirated the content from the serial...at least until the EXE is cracked! :)

Sounds good to me, but if you want to skip the list of serials you can go for a serial directly based off the name itself. A lot of products with serials does this. You can for example use part of an md5 hash based on the username together with a salt. It'll work until someone creates a key generator.

Yes, that does make sense, and it's easier to implement.

What's nice is, using this method, I can still generate a unique key for every single piece of premium content, so that a separate keygen will be required for each piece of content. Might as well multiply the time it takes for pirates to crack the software by the number of pieces of content that are available!

Thanks again! :)

Well you could also just go the route of tying the digital downloads to an online account. Basically your users would create an account online in order to buy the premium content. Any content they purchase would then be linked to that account via some database entries.

Then the user can download that premium content from special links inside their account page. You could track the downloads to see just how many times the content has been downloaded from any particular account. So you could easily spot a suspicious account that's being shared by someone. Since nobody would need to download the same premium content dozens and dozens of times... it would be like a red flag.

I'm also a fan of this account locked method because it means the only way other people can download the content or the latest updates is to get someone's account... The first thing that happens when account info is given out is... you guessed it, somebody gets greedy and changes the login info so nobody else can get in. So basically the pirates become their own worst enemy.

Of course, this really doesn't prevent people from downloading the content and then uploading the content somewhere else for others to take... but it does provide a bit of protection...

Just the hassle of having to wait for the new content/updates to show up in pirate sites would be enough reason to just get an account and buy the stuff.

But again, this isn't really going to keep out anyone who is determined to steal your game or whatever... But really, I'm not too big of a fan of any security... My take is that if people want to pay for your game, they will. If they don't, they won't. The people pirating your game most likely weren't going to ever pay for it anyway, even if they had no other choice. They just wouldn't play it.

But just as a side note: If you did the account method and someone downloaded the content to then reupload somewhere else, you could always plant a little flag in the user's downloads, so if you go to a pirating site and download that content, you could use some sort of method to find out what user account is distributing it... Then you could shut down their account. =P But that's probably the most evil thing to do.

In regards to logging IP's I would be careful in what you ban. For instance, I would steer away from banning more than one IP if it's from the same locale. If someone just wanted to take it over to a friend's house or something, they could have their serial banned, which I personally think is wrong.

So you'll need a method to keep track of that. I would mainly worry about either A). simultaneous activations B). activations from more than one country, or in the case of the US, more than one state, etc. But I realize that can become a pain very quickly. An even worse pain though would be banning people for silly reasons like taking it to a friend's house to play (Note: Letting friends play is NOT sharing with "online friends"). Also, a person technically could have multiple IP's in one home if they so chose for some reason. A friend of mine did that when we were rooming together. Cost a little extra to have, but we did it because some games had conflict with us playing online from the same IP.

In regards to the DRM, I agree that DRM should only be there to prevent casual piracy for the people who aren't too computer savvy. It helps keep honest people honest. But trying to prevent hard core piracy is a losing battle. Not even top publishers in the game industry can stop it so it's a futile effort.

Some companies like CD Projekt release games with zero DRM. Games you buy from them on gog.com have no DRM at all. Even their upcoming release of The Witcher 2. It works fine for them apparently. They know their games are being pirated, but they would be pirated regardless of any DRM scheme they can come up with. It also serves as a way to generate positive publicity because of all the backlash against DRM lately. So given that, it is something to consider on whether you should have any DRM at all. I personally agree with Nifflas on not having any DRM at all, but it's ultimately up to you.

Best way to prevent piracy:

* Keep the price tag low (definitely under £10 for a klik game),
* Provide a free demo without too many limitations,
* Make it easy to pay, and make sure the buyer has instant access to the game as soon as they have bought it.

Do that, and you remove most of the incentive to use illegal copies.

What I would do, is have a single game download (instead of separate downloads for the demo and full version).
To activate the extra features, the user would need to enter a serial, which would be checked against a list of banned serials online (just once).
Don't bother creating user accounts or logging IPs or anything - just google for illegal serials every few months, and blacklist any you come across.

Noone's going to bother creating cracks or keygens for a cheap Klik game - it's not worth their effort.

Muddy is right I think...

Why does amyone pirate anything wether it be a CD, DVD or game? Mainly because they hate being ripped off in the first place.

Produce a good quality product that the user will want to purchase and allow the user to purchase it at a sensible price.

Whatever you do, someone could and probably will find a way around it so why bother? If the big boys cant beat the pirates click products cirtainly cant.

The App that I am building at present could easily retail in excess of £100 but I'm going to set it below £30. Not be gready and still make some decebt money out of it.

Quote:

---

Originally Posted by MuddyMole

* Keep the price tag low (definitely under £10 for a klik game),

[..]

Noone's going to bother creating cracks or keygens for a cheap Klik game - it's not worth their effort.

---

That's a bit prejudgemental - how does using MMF have anything to do with the quality of the game?

Quote:

---

Originally Posted by MuddyMole

* Keep the price tag low (definitely under £10 for a klik game),

[..]

Noone's going to bother creating cracks or keygens for a cheap Klik game - it's not worth their effort.

---

Yeah, like no one pirated the humble indie bundle that you could have gotten for $1 if you really wanted (which is already pathetic in my opinion).

Quote:

---

Originally Posted by Jamie

Quote:

---

Originally Posted by MuddyMole

* Keep the price tag low (definitely under £10 for a klik game),

[..]

Noone's going to bother creating cracks or keygens for a cheap Klik game - it's not worth their effort.

---

That's a bit prejudgemental - how does using MMF have anything to do with the quality of the game?

---

I think he was coming from the angle of there being a lot of amateur games made in the Click community. However, that's not a fair assessment because those are generally from people learning the program, making a simple Flash game, and/or having no intention of charging for them in the first place because they are just simple things made for fun.

It's not really fair to say Click games are cheap amateur games. Plenty of people have made quality games that are for sale. Most of those "cheap Click games" are merely from hobbyists learning the ropes.

Quote:

---

Originally Posted by Konidias

Well you could also just go the route of tying the digital downloads to an online account. Basically your users would create an account online in order to buy the premium content. Any content they purchase would then be linked to that account via some database entries.

---

This was my original plan, but if I don't then have the game connect to the server to do a verification of the account every time the player runs the game, it seems like a wasted effort to me, since players can still exchange the content installer itself. In that case, why bother forcing customers to make an online account at all?

Unless there's something I am missing, I do not see the advantage of having a user account simply to restrict sharing the premium content installable files, since I can already do this by having a temporary download location activate upon purchase. It just adds an extra step for the customer to have to do.

Quote:

---

Originally Posted by Shawn

In regards to the DRM, I agree that DRM should only be there to prevent casual piracy for the people who aren't too computer savvy. It helps keep honest people honest. But trying to prevent hard core piracy is a losing battle. Not even top publishers in the game industry can stop it so it's a futile effort.

---

This has always been my philosophy regarding DRM, as well. All three of my previous games were pirated within a few months. I tried to track the number of downloads of my last game (which was about 7 GB on two DVDs) by finding any pirated download links I could that counted the number of clicks and stopped counting after I reached 10,000...and that didn't count torrents, untrackable downloads, and sites I missed. If I sold that many copies of my games, I'd be a lot richer!

However, I refuse to inconvenience genuine customers. My past games contained no DRM whatsoever, meaning pirates could simply upload the game as-is and play it. I do want to contain SOME protection this time, just because of the change from a "single charge" scheme to "free to play" one.

Quote:

---

Originally Posted by MuddyMole

What I would do, is have a single game download (instead of separate downloads for the demo and full version).
To activate the extra features, the user would need to enter a serial, which would be checked against a list of banned serials online (just once).
Don't bother creating user accounts or logging IPs or anything - just google for illegal serials every few months, and blacklist any you come across.

Noone's going to bother creating cracks or keygens for a cheap Klik game - it's not worth their effort.

---

There is no demo involved here. The entire game is going to be free to play. There will be purchasable premium content available that is completely optional. Think along the lines of an MMORPG like Dungeons & Dragons Online. The game is entirely free, but players can buy items and extra quests.

Also, I do think it's a bit short-sighted to assume that all Klik games are going to be cheap and not worth pirating. Most of my games have multi-thousand dollar budgets, and I know that there are others here who also produce works of professional quality. Our games and applications might be small compared to industry titans like EA, yes, but not everyone here is working on amateur projects. :)

I will say, though, in your defense, that this Klik project of mine is a bit of a departure from my normal games, and it is a bit of a risk, because I've never seen a game quite like it. For all I know, it will flop. That's why I'm making it "free to play". For all I know, people will CONSIDER it amateur, because it's unique.

Thanks for your thoughts, everyone!

One last thing: I want to prevent a counter-argument to those that think pricing a game cheaper makes it less prone to piracy. While I do agree that pricing a game too high will make people feel ripped off and want to pirate a game, pricing it too low also promotes piracy.

I am a game design major from UAT. According to several of the professors I had, market research studies have been done that indicate people feel the most guilty about pirating content if the software is priced mid-ranged. Imagine a bell curve. If the game is priced too high, then people feel ripped off and want to buy the game. If the game is priced too LOW, however, people also do not feel guilty pirating it, because they think they aren't "stealing" much money from the developer.

For instance, in the game I am developing, most premium content will be between $1.00 and $5.00. If someone buys one $1.00 piece of content, how guilty would that customer feel about sharing it with friends, since it's only a dollar? Not very.

My belief is that pricing most indie commercial titles between $10.00 and $25.00 is best, depending on the game. Of course, it's hard to make blanket statements like that without seeing specific games. There are always exceptions to this generalization!

No, it's not short-sighted or judgemental - it's just being realistic. MMF2 can be used to make some very entertaining little games, but it simply has too many limitations to produce genuinely high-quality games.

And when you say your games have a "multi-thousand dollar budget", why don't you show me the game you made that actually made a multi-thousand dollar profit?
Anyone can spend 50hrs making a game, and if they value their time at £15/hr, they have a thousand dollar budget too - doesn't mean the game's going to be any good though.

Also, the pricepoint you gave was about what I said (I was talking GBP). I never suggested charging £1.

I've just had a thought. Maybe you could get your users to register for a serial number for the free version and append it (encrypted) to the main exe. Then when they buy the premium, you append their serial number (encrypted) to the premium content file before it's downloaded. Then once it's been installed, you check that serial number against the one on the main exe. If the numbers are different, then you'd disallow use.

I am not sure how practical it would be, but, it could be worth a shot I guess.

Quote:

---

Originally Posted by MuddyMole

And when you say your games have a "multi-thousand dollar budget", why don't you show me the game you made that actually made a multi-thousand dollar profit?
Anyone can spend 50hrs making a game, and if they value their time at £15/hr, they have a thousand dollar budget too - doesn't mean the game's going to be any good though.

---

Not that I feel the need to prove anything to you, but my company can be found at www.unimatrixproductions.com. I am 27 years old, and this is my business and sole source of income. I will be attending GDC and have worked with industry professionals. Each of my games has been commercially published. I've also worked on other indie titles that were published. I am not looking for any comments on my works, as that is not the topic of this discussion. Now, can we please get back on-topic?

Quote:

---

Originally Posted by Game_Master

I've just had a thought. Maybe you could get your users to register for a serial number for the free version and append it (encrypted) to the main exe. Then when they buy the premium, you append their serial number (encrypted) to the premium content file before it's downloaded. Then once it's been installed, you check that serial number against the one on the main exe. If the numbers are different, then you'd disallow use.

I am not sure how practical it would be, but, it could be worth a shot I guess.

---

In other words, once the player buys a piece of premium content, they must enter in the serial for their copy of the main game, and then the installable EXE of the content becomes tied to that serial? It's a good idea! I'm not quite sure how to implement it successfully, but I'll run a few tests. Thanks! :)

Quote:

---

No, it's not short-sighted or judgemental - it's just being realistic. MMF2 can be used to make some very entertaining little games, but it simply has too many limitations to produce genuinely high-quality games.

---

Just as I think that "positive thinking" can be delusional, being overly pessimistic can be exactly the same. I don't like when neither is confused with being realistic. A Saira keygen appeared the same week as the release, so where's your "realism" in that would nobody bother to crack a klik game? Also, Saira made it to Steam, and though I may not be rich I live off the profit, and I got many really positive reviews. Sure, MMF have quite a bunch of limitations that gets in my way all the time, but it's still not only the product that creates the game.

Besides, I thought this was pretty clear in the original thread:

Quote:

---

note that this is a project from someone who already has multiple commercially-published games, so please no sarcastic comments about anti-piracy not being an issue unless the game is worth pirating.

---

Quote:

---

Originally Posted by Looki

Yeah, like no one pirated the humble indie bundle that you could have gotten for $1 if you really wanted (which is already pathetic in my opinion).

---

Not only this, pirates are pirating free games too XD
I know because we made a freeware game that became reasonably popular and can be obtained from a number of places for absolutely free... but guess what - they just had to pirate it XD

Quote:

---

Originally Posted by RayMarble

Quote:

---

Originally Posted by Looki

Yeah, like no one pirated the humble indie bundle that you could have gotten for $1 if you really wanted (which is already pathetic in my opinion).

---

Not only this, pirates are pirating free games too XD
I know because we made a freeware game that became reasonably popular and can be obtained from a number of places for absolutely free... but guess what - they just had to pirate it XD

---

That doesn't make sense... you can't pirate free games... If they are just downloading it from a source that you didn't upload it to, that's not exactly pirating.

You cannot pirate something that is free. That's sort of defeating the definition of stealing.

I say since you are selling through paypal, you probbaly have their email addresses to generate a serial from it. Send the serial over to the user so while installation, the user keys in that same email address with the corresponding serials. The installer already has a email to serial generator so if both matches up, the user is ready to install.

For added protection, checks if there is an internet connection, if there is, try to connect to an authentication server. If the serial does not match the email or that particular serial / email match is flagged as a pirated copy then send a 'disable' back to the client which disables it. If there is no internet connection just ignore the authentication. Wouldn't want to kill off the non connected user now would we? Also this is good for statistics...

And the best of all, pirate the game yourself. Upload a flawed version to every pirate bay you know :D

Just my thoughts.

BTW, nice point and click games :D You should try BigFish distribution or maybe you have :D

Thank you.

Quote:

---

Originally Posted by turtle

And the best of all, pirate the game yourself. Upload a flawed version to every pirate bay you know :D

---

You know, this has NEVER occurred to me before, but it's a brilliant idea! After all, I assume there's nothing illegal about "pirating" your own work. So long as it doesn't damage anyone's computer, I don't see any harm in this. Thanks for the idea!

That's absolutely brilliant!!

Very clever!

You can make it crash at random times too using the crasher object :)

You might want to throw in the message:

"Error while re-checking registration... retrying in 5"

If everything else fails... just post in the forum (comments) where you find the pirated copy that it has a backdoor trojan/ virus. Always do that to those torrent links where your software is being pirated or any forums post that links to illegal downloads of your software.

Quote:

---

Originally Posted by Konidias

That doesn't make sense... you can't pirate free games... If they are just downloading it from a source that you didn't upload it to, that's not exactly pirating.

You cannot pirate something that is free. That's sort of defeating the definition of stealing.

---

I'd argue that even uploading it to a dodgy site without permission (it clearly says "Do not distribute" in few places etc etc) is already "pirating"... but if they add a "Group 'Random Guys That Release Free Stuff Because They Love You' just released this fine warez for you guys, enjoy!" (which is the template text they use for their warez stuff) I see it as mindless pirating reflex.

Quote:

---

Originally Posted by RickyRombo

That's absolutely brilliant!!

Very clever!

---

I think Cliffski (and some other developers) used to do this regularly, not sure he's still doing it. Here's also how some other companies tried to use torrents to their advantage, might be an interesting read.

Quote:

---

RedLynx has admitted that in order to market Trials 2: Second Edition on PC it leaked it to torrent sites for pirates on the same day it was released to paying consumers, GamesIndustry.biz reports.

The pirated version of the game does not include support for leaderboards, said company CEO Tero Virtala, a crucial feature that is the "soul" of the game. Without it, he hoped users of the hacked version would want to upgrade to the legitimate copy once they began enjoying the game.

---

Here's the way I'd do it:

1. On buying the program a verified credit card number is required either to buy the software or for security reasons along with an account that matches with the credit card.

2. Then after the software is downloaded and ready to install the installer should open and you should be required to enter your account info and for the serial code it should be the credit card number.

This will work because since a credit card number is required most people will be to afraid that people will steal their credit card info so they won't share it. The only way most people will still share the software is with their friends and family, but I really don't see that as much of a problem. Of course as you were afraid of internet is needed but only once and who really doesn't have the internet now a days?

Hope this helps!

Quote:

---

Originally Posted by CBSection31

Quote:

---

Originally Posted by turtle

And the best of all, pirate the game yourself. Upload a flawed version to every pirate bay you know :D

---

You know, this has NEVER occurred to me before, but it's a brilliant idea! After all, I assume there's nothing illegal about "pirating" your own work. So long as it doesn't damage anyone's computer, I don't see any harm in this. Thanks for the idea!

---

It's perfectly legal, assuming as you said you don't damage someone's computer with it or other shady stuff.

Copyright would have to be enforced by you, so you could upload it a million times. It's your work after all. Nobody gets in trouble for pirating unless the entity with the rights to the product decides to sue.

Quote:

---

Originally Posted by clankfan1

Here's the way I'd do it:

1. On buying the program a verified credit card number is required either to buy the software or for security reasons along with an account that matches with the credit card.

2. Then after the software is downloaded and ready to install the installer should open and you should be required to enter your account info and for the serial code it should be the credit card number.

This will work because since a credit card number is required most people will be to afraid that people will steal their credit card info so they won't share it. The only way most people will still share the software is with their friends and family, but I really don't see that as much of a problem. Of course as you were afraid of internet is needed but only once and who really doesn't have the internet now a days?

Hope this helps!

---

Using people's credit card numbers is not a great idea. You might as well shout out "we don't trust our customers". Not to mention, you're losing any customers who don't have a credit card.

Also, a credit card number by itself doesn't really do much these days... You'd still need the name on the card, the expiration date, and probably the security code on the back.

It's a nice idea in theory, but it's a step too far I think. Not to mention, what's to stop people from distributing the files after they have been installed? Just seems like you're giving people a reason to avoid paying for your game. I don't want my credit card number being used for anything except it's original purpose.

Even web stores doesn't show the entire card number if you're on your own account page, they just displays the four last digits so you can easily see it's the right card.

Using credit card information is simply way out of the question.

Sending a credit card number to your authentication server is not secure and the info could easily be stolen. You'd have to have some really good encryption going on there. And if you aren't sending it to an authentication server, if they have to use it as a serial number then somewhere on their computer their full credit card number is going to be stored. Most people would probably be upset their credit card number would be used freely in that manner.

It's just opening a can of worms and I'd avoid it altogether.