Jar security

Question

I have a standalone Java app that has some licensing code that I want to secure, i.e., prevent users from changing my software to circumvent the licensing. What is the best way to do this?

I've looked at obfuscation, but that entails all sorts of problems: reflection, serialization, messed-up stack traces, etc. Perhaps jar signing could be a solution? But how do I verify the jar at runtime? And how do I ensure that the user doesn't change the jar verification code?

Answer 1

Sorry, if your users are savy enough to tamper with your class files, they will remove the signature checking features first thing. I agree with obfuscation, but shouldn't a good obfuscator keep some dictionary to convert an obfuscated stack-trace for you?

This discussion is really old, and really really complicated. Just look at the game industry. Maybe you should consider shipping a guitar with your application?

Combine the two, and you should have good synergies.