Protecting Distributed MDEs from being Copied

[margoo]

hello fellow Access Developers

I have developed an Access database program (97/2000/and XP versions) for which a market already exists. These people want to be able to purchase program via internet. So I have a web site / PayPal / Autoresponder set-up that will automatically email customer with the program as an attachment upon confirmation of payment.
The MDE file is encrypted, and SHIFT and F11 keys disabled.

My question: HOW do I keep one paying customer from distributing copies? (my market is an association of people who work in various regions throughout the State, but meet frequently throughout the year).

Two years ago, when I developed the first edition of this program, a customer - a regional director in fact - distributed my program to those he supervised. Yes, it was copyrighted, but attoney fees are prohibitive. Now the state safety code has changed and he, and those he gave it too, can't use it anymore. I have a new edition ready to sell, but I don't want to open my self up to theft again.

I would like to make it so only the pc that downloads the email attachment can run the program.

I read somewhere in this forum about writing to the Windows registry. Can anyone tell me how to do this?

If I use WinZip and bundle an executable file with the mde, the exe file will execute upon unzipping the archive. I could have that exe, or batch file, rename a font file for instance. I could write an AUTOEXEC macro in the mde that would run everytime the mde is open to check for that font file change. If it doesn't exist, Access quits.

Can anyone tell me how to write a macro in ACCESS that would check a file's existence or properties outside of ACCESS? Or does anyone have another idea to prevent easy copying?

Even if I can accomplish the above, I still have the problem of customer just downloading his email attachment onto a different computer (especially if his email is web-based). Does anyone know a way I can have the email and/or attachment self-destruct after opening, or within minutes of initial opening.

I know I won't be able to protect it from a hacker, I just want to protect it fom being copied by the average Joe.

 

[pduke]

There are some pretty good ideas for securing an Access db to be found here:

http://www.granite.ab.ca/access/demo.htm

I realize this isn't exactly what you're trying to do (distribute a demo), but most of these strategies seem like they more or less apply.

In fact you may want to make the initial download a "demo", of sorts. Like, a fully functional version of the software that will only run 10 times or whatever. Then have a mini-app of sorts, within your access db, that nabs a unique ID for the machine it's installed on, then makes a request to your website for a key that unlocks the software only on that machine.

One simple strategy (which I use) to make the db pretty much worthless to copy, is to hardcode the customer's name/logo into all reports and forms. This only works if creating reports to be distributed by the customer is the main function of your software. Plus this could be tough to automate reliably (I usually wind up tweaking the rpts. by hand a bit to get them looking right).

As far as the registry goes...you can certainly write/read to it from VBA, though you have to use windows api calls (at least I don't think there are built-in functions for this in VBA). How are you deploying the software anyway? If you're using an install-program builder, like InstallShield or Wise or whatnot (InnoSetup is the one I use -- very excellent program, and 100% free, even for commercial use), it is trivial to make/read registry entries during the install process. While it is almost always wise to use meaningful names and a logical hierarchical structure for your registry entries, it is certianly possible and easy to bury information in there, obscuring it from 99.9% of users (even if you don't try to hide it, very few non-programmers seem to have any real knowledge of the registry or would think to look there).

Finally...I don't know if it's possible with macros, but checking for existence of files, etc. is simple enough with VBA. Anyway, I would advise getting rid of any and all macros in your database (replace w/ code) before calling it a commercial release. Generally speaking, this will make your app more secure and more reliable (assuming the code is solid, of course).