PAHUD wanting to connect to the internet
 

I contacted the makers and remarked that I thought that PAHUD constantly connecting to the internet was unnecessary and represented a security risk. They replied:

"I am sorry you are uncomfortable with that; however, there is no security risk involved. We have thousands of customers who have never had any problems with this."

Is this correct? Am I the only one who feels that software should only connect to the net when it is necessary for its functionality?

Re: PAHUD wanting to connect to the internet
 

It's necessary for updates I believe?

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
It's necessary for updates I believe?

[/ QUOTE ]

Even if you disable updates it still tries to phone home.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
[ QUOTE ]
It's necessary for updates I believe?

[/ QUOTE ]

[/ QUOTE ]
it's necessary for warez hunting (aka the developer want to know where and how his babies are running - e.g. wheterh you don't use one license on 10 computers etc. etc.)

[ QUOTE ]
Am I the only one who feels that software should only connect to the net when it is necessary for its functionality?

[/ QUOTE ]
no.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
Is this correct? Am I the only one who feels that software should only connect to the net when it is necessary for its functionality?

[/ QUOTE ]

No. It's why I won't buy PT/PAHUD. I am hoping "Holdem Manager" doesn't do this so I can buy it when it is ready.

Re: PAHUD wanting to connect to the internet
 

I think you can just tell your firewall to not allow it access to the internet.

If windows firewall won't do this, get black ice.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
I think you can just tell your firewall to not allow it access to the internet.

[/ QUOTE ]
then the Pahud won't work.

[ QUOTE ]
It's why I won't buy PT/PAHUD. I am hoping "Holdem Manager" doesn't do this so I can buy it when it is ready.

[/ QUOTE ]
QFT. Hope that rvg72 reads this post.


BTW. there's a solution, but it's illegal...

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]

I contacted the makers and remarked that I thought that PAHUD constantly connecting to the internet was unnecessary and represented a security risk.

[/ QUOTE ]

Why do you think it represents a security risk?

Re: PAHUD wanting to connect to the internet
 

because there's someone who can interact with your computer (related to poker: there's someone who can see your cards).

Basically I shut down everything "suspicious" while playing.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
because there's someone who can interact with your computer (related to poker: there's someone who can see your cards).

Basically I shut down everything "suspicious" while playing.

[/ QUOTE ]

But allowing PAHUD to connect to the internet and verify itself ensures that is legitimate and not a hacked/pirated/etc. version.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
Why do you think it represents a security risk?

[/ QUOTE ]
Because PAHUD could be stealing passwords and other sensitive data and sending them back to its makers.

I trust PAHUD but that is an act of faith on my part. I don't actually know what it is sending when it phones home. That makes it a security risk.

I have a lot of security software on my machine. In general I am concerned by any application that is asking for permissions it doesn't need to do its job. PokerAce doesn't need internet access to be a HUD.

It's worth remembering that you don't always know who you are trusting. A couple of years ago a highly respected affiliate innocently distributed a rakeback calculator. Unfortunately the developer they hired secretly embedded a rootkit which circulated for months before someone detected it.

So there is a security risk here but hopefully it isn't serious. This thread represents a mutual lack of trust. Developers don't trust people not to pirate their software. Software users don't trust developers not to distribute trojan horses. They both have good points. Welcome to the 21st Century.

Re: PAHUD wanting to connect to the internet
 

I agree with all of this. I hate the fact that PAHUD authenticates itself periodically. At least it doesn't do it all the time. On the other hand, it seems unnecessary for this software in particular (poker players are so involved with money that they'd just pay if they want to use it), and poker players have more reason than most to not want their software to be reporting to untrusted locations.

I saw somebody mention PT doing this. As far as I can see PT doesn't authenticate at all. The website insinuates that it does (they mention disabling installations if you install on over two computers), but I have seen no evidence of this. It can look to see if there is an update, but you can enable/disable this.

End result is that I begrudgingly just decided to trust the PAHUD developers. Unfortunately I think we'll see this in PT3 too.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
But allowing PAHUD to connect to the internet and verify itself ensures that is legitimate and not a hacked/pirated/etc. version.

[/ QUOTE ]
in fact it's the other way. You allow some application (PAHUD here) to communicate without knowing if it's legitimate.
Correct me if wrong but AFAIK Pahud doesn't use any kind of certificate.

In fact you may be using a pirated version that reports itself to some shady people. If you don't verify that it communicates with PAHUD author (his IPs) it can be communicating with a hacker as well.

You know there's a version that doesn't connect openly to the servers, do you (I don't recommend anyone using this version, I only mention that there is).
(I don't use any becuase I don't want to allow legal version to communicate nor want to have some illigal version that can comunicate in some secret way).


[ QUOTE ]
(they mention disabling installations if you install on over two computers), but I have seen no evidence of this. It can look to see if there is an update, but you can enable/disable this.

[/ QUOTE ]
there are many sw developers that claim such a thing but usually you can go with few computers (they don't want all that hassle with every second user). They have it there if you share your keys they don't need to argue if you use dial-up about IP addresses.
They show you "7.35 your serial was connected from 2 IP addresses at once" and you serial is canceled. That's the purpose of that "only one computer" in most cases.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]


BTW. there's a solution, but it's illegal...

[/ QUOTE ]

Tell us the solution. It isn't illegal to post the solution.

People that say things like this should be banned if they don't post the information. Very annoying.

Re: PAHUD wanting to connect to the internet
 

Stellarwind's right in all his points and the PT3 developers just told me they will be continuing this policy when it's released. This is a tipping point for me. When PT was the only thing out there I begrudgingly accepted PAHUD's policy. Now that there is competition it's time we push back.

I was planning on purchasing PT3, but if they continue to do this and Holdem Manager does not, I'll learn how to use Holdem Manager instead.

Re: PAHUD wanting to connect to the internet
 

^^^^ agreed

Re: PAHUD wanting to connect to the internet
 

It would fit with some comment from the pahud developer/frontman.

Or will they just dodge/check this question.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
It's why I won't steal PT/PAHUD. I am hoping "Holdem Manager" doesn't do this so I can steal it when it is ready.

[/ QUOTE ]

FYP

I'm not accusing you of being a theif, just pointing out that your average user will only really be worried about this if they have pirated/cracked software - which is exactly why I expect we will continue to see this feature on most new products.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
your average user will only really be worried about this if they have pirated/cracked software

[/ QUOTE ]

I'll pay for PT3 just as I paid for PT and PAHUD. I won't, however, allow programs access into my computer if it can be helped. Read Stellarwind's comments about the so-called rakeback calculator.

Others more knowledgable can comment, but it is my understanding all these so called copy protections can be circumvented anyway and that most likely includes something that connects to a registration server. Sounds to me like that was already hinted at earlier in the thread. So the only ones that are suffering a risk from some malware are the legal users and I grit my teeth every time my firewall alerts me PAHUD is transmitting info.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
Tell us the solution. It isn't illegal to post the solution.
People that say things like this should be banned if they don't post the information. Very annoying.

[/ QUOTE ]
People with half a brain will know what's the secret solution. It's called "crack". And yes it's illegal to post such a link on this forum (well I haven't ever posted but if they ban using "torrents" then I doubt the mods would tolerate this).

Re: PAHUD wanting to connect to the internet
 

I started out with a registration system that didn't connect to the internet. After months of dealing with dozens of daily emails saying "I need a new code", I implemented the current system. After that, I was actually able to spend the time I used to spend generating registration codes (for new and existing users) doing something useful. It was also nice for my customers, as they could reinstall PA Hud without having to wait for me to get back to them with a new registration code.

I realize there are some people who will be paranoid and not trust an established company that has been around for years without any sort of scandalous issues. That's why we are trying to accommodate these users. See this post from the PT3 thread:

"I'm going to end this whole argument by saying we will have a system where you can be registered without PT3 connecting to the internet. HOWEVER, you will get two installs this way. After those two installs, you will need to purchase again.

An example. You buy PT3 and don't want it to connect to the registration server. You get your code (that's one). A month later, you format your computer and get another code (that's two). The next time you need to register, you will have to purchase another copy.

The reason for this is that we have no way of knowing that you didn't just install PT3 on two computers and are looking to install it on a third. The reg-server method lets us monitor this kind of thing. Therefore, the reg-server method means you can format your computer as many times as you wish on one purchase.

Therefore, people who are overly concerned about PT3 connecting to the internet get what they want, but at an added cost, due to the lack of security on our end."

Software piracy is a very real threat. I've spent a lot of time and money on piracy prevention. It's not hard to find pirated versions of software. I'm just fortunate that the hackers haven't been smart enough to figure out all of my piracy prevention methods yet, so using a pirated version of my software gives you very little benefit over using the trial version. Of course, the $25 saving isn't really worth it as you'll likely suffer from the trojan horse virus the hackers injected into their cracked version.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
just pointing out that your average user will only really be worried about this if they have pirated/cracked software

[/ QUOTE ]
in fact it's the only situation you don't have to be worried.
I don't know why PAHUD do this but Microsoft targets "friends" with it's validation. I mean: one person buys a license and then his whole family and a bunch of friends uses this one copy of Windows.

But talking about cracks: I've never cracked anything but I think there's very little to no difference. The cracker either has to patch the routine that verifies the s/n or the routine that connects to the server.

[ QUOTE ]
it is my understanding all these so called copy protections can be circumvented anyway ... So the only ones that are suffering a risk from some malware are the legal users

[/ QUOTE ]
that's my understanding as well. The cracked version connects nowhere (although I tested only when deciding what to do so take caution as any sw can connect in some hidden way).

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
I started out with a registration system that didn't connect to the internet. After months of dealing with dozens of daily emails saying "I need a new code", I implemented the current system.

[/ QUOTE ]

I have absolutely no objection to PAHUD connecting once for registration - it is the ongoing connections that I have an issue with. I can understand your concern with pirating, but I don't see why I have to take a (minor) risk to protect your business when any competent software hacker will find a way round this protection anyway. As I have a use for the product I'll have to put up with it, but don't pretend that it isn't an issue.

Re: PAHUD wanting to connect to the internet
 

The primary use of the registration system isn't really to reduce piracy. It's to prevent accidental and deliberate abuse of purchased licenses. The registration system is to allow my customers the flexibility of upgrading/formatting their computers without having to worry about asking for a new code. The software must connect every few days in order to determine if other computers have used the code. A one time registration connection would be useless for this application.

Re: PAHUD wanting to connect to the internet
 

[ QUOTE ]
The primary use of the registration system isn't really to reduce piracy. It's to prevent accidental and deliberate abuse of purchased licenses.

[/ QUOTE ]
yea, I though so. It's like the microsoft's on-line registration. The primary target are "friends" of someone who bought one single licence and want to share it.


But it's good you try to find another solution for those who don't like progs communication with random servers (though they are somewhat trustworthy).