Secure software licensing with Python

Question

I am looking to sell some software that I have written in Python. My interface allows the user to submit their license key and save it locally. The program revolves around one button in the interface which runs the program. My idea was to create a HTTPS API (probably using Flask since I know how to use it) on an AWS EC2 server. Then, whenever the user clicks the button to run the server, the program retrieves their locally stored license key and makes a GET request to the server. The server then checks for the existence of that key in the database, and if it exists then it returns True, otherwise it returns False. Then the local program will run the program if True is returned, otherwise it will tell the user that their key is invalid.

I am aware that this is not particularly secure. The main reason I see is that with Python, the user can just go into my .py file and set the boolean to always be True, or just remove the check entirely. And so, I thought I might be able to combat that by using py2exe, although unpy2exe exists. pyarmor also seems like an option, but I think some tools might exist to crack it such as this one.

Even if I am able to prevent the user from accessing the code, is it not possible for them to change the response from the server and change it to True? Even if it is HTTPS?

I also have the issue that I would only like the user to be able to use my program on one computer at a time. I thought of storing their MAC address, but I know that can be easily spoofed, so I'm not really sure how to go about implementing that.

Some might say that this is going overboard, and if someone wants to crack my software then they will do so. However, this program will be quite expensive and will be sold into a market in which cracking is quite common. Therefore, I would really like to do my best to make it as difficult as possible.

So, does anyone know how I could create a secure licensing system for my program? At least just a general outline would be extremely helpful.

Thanks.

EDIT: With regards to securely generating license keys, how is something like this if I make sure it doesn't already exist?

from base64 import b64encode
from os import urandom

random_bytes = urandom(32)
license = b64encode(random_bytes).decode('utf-8')

EDIT2: Surely there must be some sort of industry standard for licensing software, regardless of whether or not it is coded in Python? How do they do it?

Answer 1

If I've understood your problem statement correctly, it all boils down to this:

1. Subscription and License Renewal Issue, and
2. Single-User License Key

After reading through your intial attempts, I can comment that you were able to swing your bat, but ultimately these methods were all emasculate.

Although I can share a few tricks up my sleeves to address the aforementioned issues, I would rather suggest that you use a third-party vendor, who are already in the licensing business and have a reputation in the game.

NetLicensing happens to be one such cost effective solution that certainly fits the bill.

For objective #1, they offer a subscription licensing model which reflects a typical subscription scenario, where the use is permitted for a certain period of calendar time and can be extended on demand and their state-of-the-art security helps you to avoid all such cracks and hacks possible (as mentioned in the post).

They also provide a solution called 'Node-Locked', which could be used to work on objective #2 where CPU serial number verification is used to enforce this type of license.

To conclude, I'd say you could always use home-cooked remedies to implement software licensing, but if your product is really worth the market and you intent to avoid piracy and restrict unauthorized usage, let the professionals take care of your business, while you focus on the product development and its distribution.