Find out who leaked your software: marked copies, decoy keys and a sign-in watch

A copy of your program shows up on a forum, or in a Telegram group, and you have a hundred customers. Which one passed it on? Without a way to tell, all you can do is change everything for everyone. The leak tracer in PWF Auth answers that question, and it works on the updates you already ship

Every customer gets their own copy

Turn the tracer on for an application, and every customer who downloads an update through your program's update check gets their own copy of the ZIP. The copy carries a mark that belongs to their key, hidden in the ZIP's comment and in one extra file inside it. Nothing else in your build changes

Because each copy is a little different, each has its own SHA-256. That's handled for you: the update check tells your program the checksum and size of the copy that customer will get, so an updater that verifies the download keeps working. A customer gets the same copy every time they download the same version

Drop a leaked copy, see whose it was

When a copy turns up, drop it on the Leak tracer page in your panel: the ZIP, the program, or the extra file from an unpacked folder. It is read right there in your browser, so nothing is uploaded, whatever its size. If it carries a mark, you see whose key it came from. Then you decide: ban the key, talk to the customer, or both

A mark catches the usual leak: the ZIP or the folder passed on as it came. Someone who unpacks it, deletes the extra file and the comment, and packs it again has removed it. It's a way to find out, not a lock

A file your program can't run without

To go further, keep one file your program needs on the tracer instead of in the update. Your program fetches it after the customer signs in, and each customer's copy carries their mark. A copy of your program that runs needs that file, so it leads back to a key even when the rest was stripped. It can be a .NET module that your program loads from memory, or plain text with the mark hidden in it as invisible characters

Decoy keys

Make keys that look exactly like your real ones and plant them where leakers look: a Telegram group, a forum, a paste site. A decoy never signs in. Whoever tries one is recorded, and their machine is refused from then on. Each decoy has a note for you, so you know which one was found and where you planted it

The sign-in watch

Most leaks start with a shared key, before any file moves. The sign-in watch flags a key used from several countries within an hour, from many addresses in a day, or in a sudden burst. Look at those keys first: banning one closes every copy using it within 30 seconds

Put it together

The tracer is one layer. With a key locked to one PC, sign-in rules and a live kill switch, it makes sharing your software a lot less attractive. The full picture: How to stop customers sharing your software

The tracer works on your app's updates: ship your first update, then turn it on