Slashdot Log In
Vista Activation Cracked by Brute Force
Posted by
Zonk
on Fri Mar 02, 2007 10:02 AM
from the disturbance-in-the-force dept.
from the disturbance-in-the-force dept.
Bengt writes "The Inquirer has a story about a brute force Vista key activation crack. It's nothing fancy; it's described as a 'glorified guesser.' The danger of this approach is that sooner or later the key cracker will begin activating legitimate keys purchased by other consumers. From the article: 'The code is floating, the method is known, and there is nothing MS can do at this point other than suck it down and prepare for the problems this causes. To make matters worse, Microsoft will have to decide if it is worth it to allow people to take back legit keys that have been hijacked, or tell customers to go away, we have your money already, read your license agreement and get bent, we owe you nothing.'"
Related Stories
[+]
Windows Vista Keygen a Hoax 154 comments
An anonymous reader writes "The author of the Windows Vista keygen that was reported yesterday has admitted that the program does not actually work. Here is the initial announcement of the original release of the keygen, and here is the followup post in which the same author acknowledges that the program is fake. Apparently, the keygen program does legitimately attack Windows Vista keys via brute force, but the chances of success are too low for this to be a practical method. Quote from the author: 'Everyone who said they got a key is probably lying or mistaken!'"
This discussion has been archived.
No new comments can be posted.
Vista Activation Cracked by Brute Force
|
Log In/Create an Account
| Top
| 470 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
MS would owe at least the key (Score:5, Interesting)
(Last Journal: Wednesday August 15, @03:36PM)
From the article summary:
I don't see how this is possible, or credible speculation even for a company a evil as MS is perceived on slashdot. I'm no MS fanboy, but I've had reasonable "service" from MS on issues of keys to activate my machines under some unusual circumstances.
This may get sticky for MS, but for goodness sake we've got to find better bashing material on MS (and I believe there be plenty) if we want to maintain any street cred. There's no WAY MS won't be giving license keys to legitimate purchasers of XP (especially considering the vast majority are pre-activated shelf-delivered versions).
(Aside: pure speculation on my part, but one of the most glaring weaknesses of this "claim" may be the notion of brute force, and that that is even a possible approach. Most validation handshakes require a reasonable length of time between attempts to circumvent brute force attacks... if it takes one second between attempts for billions of combinations, you're going to eventually be activating an obsolete OS. Further, after 3 or 4 incorrect attempts, any validation scheme worth its salt will quiesce for some longer inconvenient time... requiring a "cooling off" period before one can make further attempts. This story falls under the heading of "I heard someone say they knew someone whose sister's brother has figured out a Vista activation hack..." Sigh.)
Re:MS would owe at least the key (Score:5, Interesting)
(http://www.myg0t.com/)
Re:MS would owe at least the key (Score:4, Interesting)
Re:MS would owe at least the key (Score:5, Informative)
(http://gildude.blogspot.com/)
Re:MS would owe at least the key (Score:5, Insightful)
(http://pitabred.dyndns.org/)
Re:MS would owe at least the key (Score:4, Informative)
Your assumption here seems to stand on rather shaky ground, though... I'm sure that you can run more services than just the authentication mechanism - I would expect that you'd probably want to run the license authentication service on your domain controller or something similar, unless you're in a really gigantic shop.
Re:MS would owe at least the key (Score:5, Informative)
How is it any different than needing a corporate license server for Autocad, or Rational, or any of the other software commonly licensed this way on the corporate level? It's not like these license servers are terribly difficult to maintain.
I think you imagine the maintenance to be a lot harder than it really is. Maintaining a single license server has, in my experience, been easier than maintaining hundreds of keys individually.
Re:MS would owe at least the key (Score:4, Interesting)
(http://pitabred.dyndns.org/)
Re:MS would owe at least the key (Score:5, Informative)
(http://www.myg0t.com/)
Sit down, son. (I might have known your mother) (Score:4, Informative)
Quit downloading everything in your email. If you don't recognize the name, delete it.
Don't click "Yes" to every security certificate. You should accept Microsoft's, and that's it.
You don't require new cursors or smiley programs for your emails. The new "Hyper-Exelent Surf 3000 Toolbar by Lucky 88 Company" is not going to make your life easier. Likewise, if you want to know the weather, look outside or in your local paper.
PC Cleaning programs from pop-up ads don't work. Actually, anything advertised on the Internet should be considered fraudulent. (Yes, even "those" pills. They're just bull semen and corn starch.)
Get your programs from sourceforge, not from the first link on Google. Make sure that Spybot and Mike's adblocking are installed on your machine.
The people who write viruses have anti-virus programs to test their work on.
For the sake of whatever god you believe in, get a hardware firewall!
Run ShieldsUP! from grc.com to make sure that you're invisible.
Re:MS would owe at least the key (Score:5, Informative)
(http://www.pkix.net/~chuck/)
Why, yes. Rechecking the activation key against an updated list of revoked licenses takes place as part of the periodic updates to "Windows Validation" delivered via Windows Update. In practice under XP, this happens every month to every few months. Depending on your settings and whatever the future might bring, it might well be the case that machines will be checking for updates & possibly re-validating themselves every week.
Re:MS would owe at least the key (Score:5, Insightful)
(http://www.alhunt.com/)
I am *so* glad Linux has evolved to the point it is today. I still have an XP partition and probably will for a while, but why MS expects people to keep putting up with this "phone home" behavior is beyond me. XP still handles ACPI better than Linux, but I'm happy to trade off a little convenience for control of my own machine.
phoning home (Score:4, Insightful)
(http://code.google.com/p/nmod/)
Valve managed it, and the rather wonderful prevx malware finder program and SETI@home all require constant contact with home, for example.
The difference is that these systems deliver customer satisfaction because the phone home service is there as part of the service you require or with to participate in. If you decide not to, you can quit and go elsewhere. Most people using windows don't see that they have a choice (yet).
Microsofts problem is that their system is one of guilt assumption. They have it solely to check up on customers, it delivers no added value aspect to the consumer. That they say it does is part of the problem. It is for microsoft alone, it gives nothing back.
No-one cares about microsofts needs, that's human nature, we are all selfish unless giving something away brings a valued return. For them to expect that people would *want* to take part with no benefit to themselves is a pretty hefty misconception.
I find these issues with Vista interesting. I really do have no intention of ever buying it. I tried it with open mind, thinking I might get it if it brought something new I might like, but there was nothing that interested me. I didn't hate it, but saw nothing of use. It's nowhere near as useful as Linux for my needs, and if I feel a need for a commercial OS, well there's OsX.
OsX does interest me quite a bit. I've seen many presentations at conferences that were done with macs, and they look *so* good.
it is useless (Score:5, Informative)
Re:MS would owe at least the key (Score:5, Insightful)
Re:MS would owe at least the key (Score:5, Insightful)
(http://www.vanderlee.com/)
If this truely starts to be a problem with legitimate users being bothered by having their keys taken, MS will have to loosen up activation. That would be a benefit to all legitimate users.
Re:MS would owe at least the key (Score:5, Insightful)
(http://www.myg0t.com/)
Re:MS would owe at least the key (Score:5, Insightful)
Re:MS would owe at least the key (Score:5, Insightful)
(Last Journal: Tuesday December 19 2006, @05:12PM)
Sorry, couldn't resist.
In the end though, this sort of corporate behavior is hugely annoying. Microsoft rose to the top partly because it looked the other way on unlicensed use of it's products, and now that it's the standard, it's trying to lock down. Well, the problem is, now there is a huge group of people who have a vested interest in using that software for free, and there is no way that they're going to beat them using a purely technical solution...Crackers are proving that on a daily basis.
Smarter of them to leave things as they were.
Re:MS would owe at least the key (Score:5, Insightful)
Re:MS would owe at least the key (Score:5, Insightful)
Unlike duplicating an mp3, here the original copy is no longer usable. It isn't just making another copy for yourself and leaving the original functional.
But the victim is MS or their customers, so it must be ok.
Re:MS would owe at least the key (Score:5, Insightful)
(http://www.hyperlogos.org/ | Last Journal: Wednesday July 18, @08:19PM)
The irony is that you think violations of IP is theft.
The person who brute force discovers and uses someone else's code is not the one causing their Copy of Windows to be invalidated. Microsoft is doing that.
This is a very important distinction.
Re:MS would owe at least the key (Score:4, Interesting)
(http://www.hyperlogos.org/ | Last Journal: Wednesday July 18, @08:19PM)
Unless you subscribe to a different dictionary, this is really quite irrelevant. Copyright infringement is not theft. It is copyright infringement. We have a whole separate area of law to address it specifically because they are not the same thing.
Well, I agree with that assertion, anyway.
Heh heh. Information wants to be free. Yeah, and my car wants to go fast.
Seriously though, I don't feel that the two situations are analogous. If I intentionally used your specific registration code to invalidate your copy of windows, well, I'm still not stealing anything. I am taking an action that indirectly causes Microsoft to invalidate your copy of windows. I agree that doing that intentionally would be wrong, but I don't agree that it is theft.
For one thing, you are still the owner of the copy of windows, or if you believe the bullshit that the computer industry attempts to push on you, the licensor. I am not. Therefore Microsoft is illegally terminating your right to use the software (whether you are in legal fact an owner or a licensor.) The fact that Microsoft would take an additional use of your key (which, as should have been obvious after the Windows XP Key generator, can be brute-forced) as a sign that you have broken the EULA or otherwise no longer have the right to use the software is the problem here.
In addition, there are legitimate reasons to use a key which is not your own. You could have legally purchased the software but no longer have box or manuals (do you even get any manuals?) and you may not even have the disc - it could have been destroyed. You are still the legal licensor, under the "licensee" way of thinking. You are still entitled to run the software, but lack the means to do so without generating another key. Microsoft, however, prevents you from using the software for which you have paid. So, you might consider generating a key so that you can use the product. If Microsoft then chooses to invalidate someone else's copy of Windows, how is that my fault?
You're acting like Microsoft is reasonable and I am unreasonable. But what's reasonable about invalidating your copy of windows just because someone else has the same key? Once, the EDD made me use a fake social security number because some mexican (I'm a quarter mexican, not that you could ever tell by looking at me) was using mine to evade taxes. That meant that my history was lost, and a new account was started for me. Was that right? But that guy had no real choice; the US has been taking gigantic shits on Mexico and helping to preserve the utterly corrupt status quo for many, many years now, because if we don't have mexicans to pick fruit and veggies, you'll be paying four bucks for a head of iceberg lettuce and sixty bucks for a bottle of crappy wine. So in order to feed his family he came here, and in order to work he used my SSN. Was the EDD's response justified? That poor field workin' dude didn't use my SSN in order to cause me hardship, but it happened anyway - but not because of him, because of the ridiculous response from t
Re:MS would owe at least the key (Score:5, Insightful)
Regardless, its copyright infringement, not 'theft' and not 'piracy'. Its really quite simple, theft is when you physically take something that doesn't belong to you. Copyright infringement is, amongst other things, when you make a copy of something you aren't authorized too.
In fact in this case the real issue isn't even copyright infringement. Suppose I use this keygen on legally purchased software. What laws are being broken?
I didn't 'steal' your key, I happened to come up with the same number MS assigned to someone else independantly. Hell, I might have come up with the number before MS, which, if anything, would make it -my- intellectual property; and MS would be infringing my copyright by issueing you "my" key string.
Which is of course absurd.
Re:MS would owe at least the key (Score:5, Insightful)
(http://127.31.33.7/)
Using Microsoft's services, such as Windows Update, could be considered theft. But that is theft from Microsoft, not from consumers.
Re:MS would owe at least the key (Score:5, Funny)
(http://www.joe-bunting.com/club)
For future reference you could try using words like:
Fuckwit, wanker, bastard, fuckhead, tosser, cunt, spanner, moron, dickhead or even shit for brains.
For example:
"The commentator on the Inquirer Web site is obviously a total fucking wanker. The fuckwit is cheering theft which is in its own right sleazy. Worse, the cretin seems to be happy that the legitimate and paying Windows Vista customers are going to be at best confused and worst case screwed because some idiot stole their key. What a fucking cock !"
I must admit I probably have the same problem in my belief that most Scottish people curse each other by calling them sassenachs.
Re:MS would owe at least the key (Score:5, Informative)
- Multiple Activation Key - will only work a limited number of times
- Key Management Services - requires a local license server that maintains the count of keys used and communicates with Microsoft
neither of which will work with your scheme.Re:MS would owe at least the key (Score:5, Informative)
Welcome to the non free world. (Score:5, Insightful)
(http://lists.clickers.org/linuxsig/index.html | Last Journal: Friday November 09, @11:00PM)
I don't see how this is possible, or credible speculation even for a company a evil as MS...
Sorry, that's their EULA. You have two choices when you purchase anything M$, return the package unopened for a full refund or use it. They do not and can not promise it will work and they are not responsible for the actions of others. They regard anything they do beyond the EULA a favor for which you should be grateful, just like they regard anything their software ever does for you. They think you should be so grateful that you do as they say. This is the nature of non free software. Your master may take care of you or they may not and those are the conditions you must agree to if you want to use non free software.
They don't trust you. They made the registration key in the first place to restrict the number of computers you can use before you pay them more. When you call and claim your key does not work, they can't tell the difference between you and someone who's shared their key. Once again, this is the nature of non free software.
Not in the UK (Score:5, Informative)
(Last Journal: Thursday August 10 2006, @12:20PM)
That may be the case in the US, but in the UK things work slightly differently. If I buy a copy of Vista from a store and it is faulty, for what ever reason, I can return it to the store for a full refund or a replacement. The legalese is "fit for purpose" and "of merchantable quality". Clearly, a copy of vista with an invalid licence key is not fit for purpose.
Incidentally, most of the big shrinkwrap software stores in the UK try to get out of doing this if they can. Just be persistent.
Re:Welcome to the non free world. (Score:5, Informative)
There's this little thing called an implied warranty of fitness for a particular purpose. When you buy something -- anything -- unless it has large letters on the outside of the box saying that it doesn't work, it comes with one. It states that, basically, if you use the product for the purpose for which it is marketed (i.e., with software, try to run it on a computer), it will perform that purpose to at least a basic level.
It is not legally possible for MS's EULA to disclaim this warranty, it's a basic right that you get when you buy something.
When you buy something that doesn't meet this warranty, you're entitled to a full refund. Whether you've opened the package or not.
What makes you think an EULA has legal force? (Score:5, Interesting)
I work for a state institution which means in a way I am a part of the state. One of the requirements of the job is that I can't sign any contracts for the state. Anything that requires a signature has to be sent to legal (and we have a hell of a legal team). Employees can't agree to contracts directly. We have, on occasion, gotten software that comes with a written agreement. It is sent to the lawyers, almost totally rewritten, then sent back to the company (who is usually quite surprised). However we've been told not to worry about EULAs or click through agreements. We are allowed to just click ok and go on about our business.
Now why do you suppose that is? Well it is because the legal team believes that they have no legal force, and thus there's no problem. I'm going to guess they are right, they have to be very careful about protecting the state against things like that.
So MS can say in their EULA "We reserve the right to take this software away from you at any time," but that doesn't mean a judge will agree. You can still drag them to small claims court (it's quite cheap to file) and argue your case. If a judge agrees with you, they give you your money back.
Re:MS would owe at least the key (Score:5, Interesting)
This may get sticky for MS, but for goodness sake we've got to find better bashing material on MS (and I believe there be plenty) if we want to maintain any street cred. There's no WAY MS won't be giving license keys to legitimate purchasers of XP (especially considering the vast majority are pre-activated shelf-delivered versions).
I think you're probably right. However, all companies in similar situations don't act this way. A few years ago I bought a Russian-English translation program for my PC. I got the best one on the market. I didn't use it a lot, but it was useful to me for quick translations from Russian to English for email. At the time I didn't know Russian as well as I do now and while I could do translations by hand, it took a very long time. It was certainly worth the money to have a computer program do it for me in a few seconds and then I could double check the weird parts and re-translate those myself. It turned what might be a 2 hour translation job at the time into a 10 minute job at worse. A year or so later I had a catastrophic Windows failure and had to do a destructive reinstall. Although I had a valid license key for the translation program, it wouldn't work after the reinstall. The vendor told me their keys are valid for one use only and although I explained that I had bought the product (and they knew I had) and had to do a reinstall of Windows, I got basically "Too bad. So sad. Here's a 10% discount off our lowest price." in response, which still meant I had to buy the product at pretty close to it's normal value. I sucked it up and did that and installed my new key. However, I was very angry because I realized that to the software vendor if I needed a new key I was probably a thief and if I wanted another key, I was going to have to pay for it. After another year or so, guess what? Yep, I had to do another destructive reinstall of Windows. I decided not to rebuy the software. The babelfish translator, which is free, is not as good, but my Russian had improved a lot and I had less real use for a computer translation program. For as little as I needed to use one, babelfish was good enough. However, the vendor of the translation program has lost me forever as a customer because they weren't willing to give me the benefit of the doubt about my problem and my choice was either to buy a new key or live without the program. Their attitude was "If you need a new key, you're a thief". Since then a guy on a forum told me the magic needed to make old keys work on a reinstall, but I've never bothered with it.
Re:MS would owe at least the key (Score:5, Funny)
Nobody will upgrade to XP--er.... Nobody will upgrade to Vista because of activation.
Yes! 199-, er...
2003, er....
2007 WILL BE THE YEAR FOR DESKTOP LINUX!!!
Easy Fix (Score:2, Insightful)
(http://www.myg0t.com/)
Re:Easy Fix (Score:5, Insightful)
(http://libtom.org/)
Tom
Re:Easy Fix (Score:5, Insightful)
Re:Easy Fix (Score:4, Funny)
Re:Easy Fix (Score:4, Informative)
Re:Easy Fix (Score:5, Informative)
Sounds like a distributed computing project to me (Score:5, Funny)
(http://nizo.deviantart.com/gallery/ | Last Journal: Thursday November 08, @09:27AM)
Re:Sounds like a distributed computing project to (Score:5, Funny)
(http://trolltalk.com/ | Last Journal: Saturday November 03, @08:45PM)
"I can see it now: thousands of computers worldwide activating keys, just to make life miserable for Microsoft and users. It could be called the "annoy Microsoft Windows Users at home" project."
Yes, but does it run under linux :-)
Actually this crack won't help most people.. (Score:5, Interesting)
As I pointed out in the post above the chance of a randomly generated working activation- key colliding with a legitimate keys is probably worse odds than 1 in a trillion. So this will probably never ever happen by chance.
However, chance might not play a role here. Given this colossal stupidity one also assumes they did something dumb like make the decoded keys have some sort of sequential pattern too, so given enough keys one might be able to figure out how to actually generate keys directly. In that case MS will have a problem with the key-collisions with legitimate keys because people could deliberately generate those.
Why would deliberately generating legitimate keys be a good idea for a cracker? Well, if you do generate a random activation key, it will activate the product but Microsoft will also be able to determine that it's one that it did not issue. So the moment vista phones home or you try to do a system update, or install any piece of software from MS that can check the key (e.g. office), microsoft is gonna shut your genuine ass down. On the other hand if you were to generate a key that coincided with a legitimate key, then MS won't know you filtched it. So there's an incentive to see if MS also made the patterns predictable.
You could of course try to live off line. but that level of piracy is not a threat to MS.
All that said my guess is that this is not possible. If I were creating these keys what I woul dhave done would be to use public key encryption. I'd take the integers 1 to 1 billion, and encrypt them with my private. The the Vista copy caries the public decode key. To validate the vista installer decrypts the user supplied key. If it's a number between 1 and billion, you've been validated. MS can now issue up to 1 billion copies of the software with distinct keys.
relax (Score:5, Funny)
(Last Journal: Tuesday September 09 2003, @01:59PM)
Perfect (Score:1, Insightful)
(Last Journal: Thursday February 09 2006, @01:35PM)
I don't have problems with any number of copy protection schemes. Granted they can eventually be defeated almost without fail, but it does rais the bar for the effort. PS disc error thing I think was a fairly clever method for example. I don't even really mind CD keys too much, although its irritating as hell to lose whatever they happened to write the code on (Is it too much to ask to print it on the damned disc?). But I absolutely refuse to touch any piece of software that requires some online activation type crap.
Except we know already what happens (Score:5, Insightful)
(Last Journal: Monday June 21 2004, @04:25PM)
Yes, there have been some fucktards too historically, but MS was sane about it so far. I'm not saying they're saintly or anything, feel free to still be anti-MS if it makes you feel any better. Just that their sane. Even if you want to see them as some kind of super-willain, well, as super-villains go, MS was the _sane_ kind so far. The kind who's read the evil overlord's list, not the random lunatic kind. It knows when _not_ to do something that would damage itself very quickly.
Look, there are plenty of real reasons to whine about MS, no need to invent bullshit FUD scenarios. That kind of going into bullshit fantasy land, just to have something bad to say about MS, just damages the credibility of the real complaints.
I Call BS (Score:2)
(Last Journal: Thursday August 16, @08:22PM)
tough questions (Score:4, Funny)
(http://evil.google.com/)
Hmmm, I wonder which way Microsoft will go on this one...
Ironically... (Score:5, Funny)
"...and the wide open vista..."
Really? (Score:1, Redundant)
Predatory Pricing (Score:1, Insightful)
1) Too many variants
2) Too expensive an upgrade from XP
3) Limitation on which versions run virtualized.
Sadly, for MS, they have not emphasized it can creditably replace a several hundred dollar Nuance Dragon Naturally Speaking install (I know, I've tried both)
Ok, so it's Microsoft... (Score:1, Insightful)
The WOPR?? (Score:1)
They just better not mention anything about Global Thermonuclear War.
Many collisions with legit keys? I doubt it. (Score:1, Redundant)
(http://www.dpbsmith.com/)
Maybe maybe maybe one lucky hacker hit the jackpot and scored one key once or something like that.
I don't believe for an instant that a brute-force attack on a 25-digit number is going to score many legitimate activation keys that a) have actually been shipped to real customers and b) have not yet been used. There are only a few billions of people in this great world, and there are an awful lot of 25-digit numbers.
How many brute-force tries were they able to make? Let's say a billion. If they were able to get even one key by brute force in a billion tries, then one-in-a-billion 25-digit numbers must be valid activation keys, or 1^16. If there are ten billion extant copies of Vista, then the chances that a valid key has already been assigned would be one in a million.
So, of every key found by hackers using brute force, only one in a million will collide with an already-issued key.
No, this will not be a customer-relations nightmare for Microsoft, regardless of whether they elect to be nice or nasty when it happens.
Is this a HOAX? (Score:3, Interesting)
Is this a HOAX?
This has me curious... (Score:2, Interesting)
It would be like a DOS on the licensing mechanisms.
Having RTFA... (Score:5, Informative)
What we have here is a random number/letter guesser. It's basically a VB Script that guesses random numbers and letters in a string that is the same length as a Vista Key, then inserts it into the registry, overwriting the existing Vista key. You use Magic Jellybean to check when the key has changed, and then manually check it against MS's activation service. Really this is little more than a person manually sitting down and making key guesses. This is why it's called a "Brute Force" attack. There is no intelligence (ie: an algorithm) behind the key guesses at all.
That said, because it IS so simple, it's almost impossible for MS to defend against, since they can't just "ban" any keys made by it like they would a traditional algorithmic keygen. Also, there is an improved version of it posted as source on the boards there, so if you want to take a peek at the code you can.
Here is a link to the forum post in question: http://keznews.com/forum/viewtopic.php?t=2634 [keznews.com]
Patch coming in 3...2...1 (Score:1)
Wow, any bias? (Score:1)
(http://slashdot.org/journal.pl?op=list&uid=911325 | Last Journal: Saturday November 10, @12:25PM)
From the summary, quoting the article:
Hell of a nice strawman. Nice job.
PR's not *that* bad... (Score:3, Funny)
(Last Journal: Friday August 17, @06:05AM)
C'mon, let's give'em credit.. their PR isn't as bad as Sony's!
I have to ask (Score:1, Flamebait)
Ways for MS to handle the problem, seriously (Score:3, Insightful)
(http://slashdot.org/~davidwr/journal/ | Last Journal: Friday November 09, @09:19PM)
If the problem is large:
Have people caught up in the duplicate-key mess photograph their Windows Vista packaging with the key showing in the photograph and send it in.
For the related problem of duplicate OEM keys, photograph the machine and mail in the make, model, and serial # of the machine and/or the name of the store you bought the license from. This won't help as much with tracking "manila envelope" licenses as those can be traded willy-nilly before the envelope is opened, but it will help with licenses that are assigned to particular manufacturers.
Give "ownership" to the person with the most convincing photo or purchase history. For the other claimants, if you are nearly 100% sure they are illegitimate sue them or make them provide personal information to get a "new, legal key, on the house" otherwise write off the loss. Pirates aren't as likely as people who think they are legitimate buyers to give out their name and address. If they balk, make a decision: do you want to risk being wrong and wind up in court and lose and get a PR black eye, or do you want to stand by your guns? If you aren't nearly 100% sure, just write it off.
In any case, if you don't immediately activate the product, at least activate it for 30 days while you decide what to do.
Even better - scrap the whole activation thing.
In the future, software will be delivered electronically and every copy will be uniquely watermarked. Yes, you can watermark compiled computer code by inserting NOPs, replacing operations with equivalent operations, etc. Of course this isn't as simple as it sounds as addresses get moved around, but it's doable.
Um, Zonk? (Score:1, Offtopic)
-1 troll much?
DRM fails for the same reason gun laws fail - the criminals can and will skate around it effortlessly, and the legit users get screwed.
Looooooong keys? (Score:2, Funny)
(http://www.geocities.com/tablizer | Last Journal: Saturday March 15 2003, @01:22PM)
They just ... (Score:1)
Brute force Crack (Score:3, Informative)
I saw one at a LAN party that had every copy of windows, every copy of office, and a whole bunch of Microsoft products.
You would set it and forget it. It would generate a key, test it and then if it was good put it in a log file, if it was bad it would attempt to generate another.
This kid had a list of probably 1000 WinXp pro keys that had generated just because he was bored.
**yawn** (Score:1)
This is Poetic Justice (Score:3, Funny)
(Last Journal: Wednesday May 03 2006, @12:27PM)
If you need the equivalent of a Cray to run Vista, then it's going to be very efficient at Brute Forcing the keys.
I like it.
Alternate download link (Score:1)
Also worth nothing... (Score:2, Interesting)
I prefer the old days (Score:2)
Honestly this whole key activation thing seems more hassle than those stupid dongles used to verify your software. They used to plug into the parallel or serial port, now they plug into USB. Why can't we just have that, seems less problematic than the current scheme. Especially when you consider that a $4 dongle won't cut into the profits of a $100 OS as badly as 20 minute tech support calls do (which generally cost a company $30 to $150 each)
If only copy protection would work (Score:1)
Get Bent -- they actually tried this already (Score:1)
I was actually surprised how quickly I got results after I told them that I had decided to file a lawsuit. I was not exactly bluffing, but I also could not have taken it much farther than the initial filing. But I was ready to go to the US Court Of Claims to say that the retailer and Microsoft had together sold me a product which did not work and that both had refused to give me a refund. After certain certified letters reached certain individuals, I got a license key, and for a couple of months afterwards, received occasional calls from Microsoft support folks asking me if my problem was taken care of.
The lessons I learned:
1. Microsoft is in denial about their software security system.
2. Threatening to file a lawsuit against a corporation engenders prompt responses.
How long . . . ? (Score:1)
Cancel or allow? (Score:1)
Get *ALL* Keys (Score:1)
(http://www.shortround.net/)
A (Possibly) Necessary Evil (Score:2)
Just to play devil's advocate, it's not like Microsoft just arbitrarily decided for no particular reason that the authentication tool was a good idea. They make a for-profit commercial product. Lots and lots and LOTS of people are using it without paying. Whether it's copyright infringement or theft, they are faced with a problem - besides obtaining this product for free, all of these "users" will place a drain on Microsoft's support systems (such as bandwidth).
Historically they've simply sucked it up, and let these people continue to leech away, but they've put their foot down. What exactly are their options? Dongles? Cracked almost instantly. Serial number alone? Don't make me laugh. I'm not sure how else they would do this, other than to require that they validate the customers serial number against white and black lists.
If people weren't working so very hard to make this commercial, for-profit product available for free, there would be no need at all for this system. It wouldn't exist.
Microsoft almost certainly sees this system as a necessary evil. If there were a better way, I'll bet they'd at least listen to it.
It's a Hoax (Score:1)
But don't take my word for it. Download is for yourself. Included in the zip file are:
slmgr.vbs - an (allegedly) modified version of the program used to activate Windows. In reality it does nothing.
keyfinder.exe - supposedly the "Magic JellyBean" key finder but in reality a trojan.
The whole point of this scam is:
1. run slmgr.vbs (which in reality does nothing)
2. wait a few hours
3. run the keyfinder to see if a new key was generated and when you do -- *BAM* you're infected.
Anyone who claims that they generated a new key with this program is a liar and probably in on the scam.
Somone Please Explain How MSFT Coders Can Do This (Score:2)
Fear mongering... (Score:2)
(http://www.openemrhq.com/ | Last Journal: Monday March 01 2004, @10:58AM)
While I am not a MS fan I do think the statement above could legitimately classified as "fear mongering". Microsoft is a business and one of the functions of a business is to satisfy (or at least look like they are trying to satisfy) their customers. I highly doubt that they would alienate a huge amount of their customer base over a few thousand or hundred thousand illegitimate activations. Doing so would be suicide on their part because it would spark a giant "Oh my god, what if that had been US" within the large business community that Microsoft serves. Large corporate customers would seriously start looking at alternatives because they would see a situation where they might potentially be left out in the cold should they buy a copy of Windows and it's activation has already been used.
This is going to be a bad situation for Microsoft. But it's not going to cause them to tell their customers "screw off".
Re:Er... (Score:5, Funny)
(http://wakaba.c3.cx/)
Re:Not too big of a deal (Score:2)
(http://wakaba.c3.cx/)
Re:Not too big of a deal (Score:2)
Re:Not too big of a deal (Score:5, Insightful)
(http://trolltalk.com/ | Last Journal: Saturday November 03, @08:45PM)
"as someone who has worked on systems such as these (oh the inhumanity!) we have looked at this particular attack vector. Yes, it is possible. But, when you consider the size of the activation code domain (quadrillions or more of combinations), with the number of legitimate keys (hundreds of millions), and the fact that each request takes some amount of time (a few seconds), it's not too big of a risk. A risk? yes. But there are lots of risks. This is just another one to be put on the list, watched, and mitigated against (as others have said, with blocked IPs and so forth)."
Obviously someone else who didn't read either the article OR all the other user comments - no net connection required to generate the keys - the attempts to change the key are done locally; after a successful local key change, submit the new key for activation.
Blocked IPs won't do jack shit for such a scheme.
Also, you're not trying to find a specific key that works, just one of many, so even with a huge wrong-key space, you'll get a favourable collision with a valid key sooner, rather than later. Its like the same-birthday problem.
Re:microsoft is sitting back, watching and laughin (Score:1)
(http://sobrique.livejournal.com/)
I can see a similar discussion being had about Vista. Home use, they're plugging on ... well, the only reason I'm considering it is my favourite game is going DirectX 10. But the cost of a new license if you _don't_ pay microsoft tax is pretty outrageous, so I might just not bother.
However for the 'average corp' the upgrade drive is just ego as suits want the 'newest thingy'.
Thanks to recent developments, linux is just about becoming a viable alternative, as being 'end user friendly'. *shrug* Too many companies are blinkered to the alternatives, but might notice a cost comparison of e.g. 30k users running a well supported linux, vs. 30k users running Vista.
Re:Hmm.. (Score:1)
(Last Journal: Monday June 14 2004, @06:43PM)
Re:microsoft is sitting back, watching and laughin (Score:1)
The interesting part is that you propose open source software as the silver bullet against the tyranny of Microsoft. Using your logic, if the world started moving to OSS in a stampede, wouldn't Microsoft lobby to make OSS illegal? Will we ever see the headline "Microsoft Overturns The GPL!" on slashdot?