PAHUD wanting to connect to the internet

[StellarWind]

[ QUOTE ]
Why do you think it represents a security risk?

[/ QUOTE ]
Because PAHUD could be stealing passwords and other sensitive data and sending them back to its makers.

I trust PAHUD but that is an act of faith on my part. I don't actually know what it is sending when it phones home. That makes it a security risk.

I have a lot of security software on my machine. In general I am concerned by any application that is asking for permissions it doesn't need to do its job. PokerAce doesn't need internet access to be a HUD.

It's worth remembering that you don't always know who you are trusting. A couple of years ago a highly respected affiliate innocently distributed a rakeback calculator. Unfortunately the developer they hired secretly embedded a rootkit which circulated for months before someone detected it.

So there is a security risk here but hopefully it isn't serious. This thread represents a mutual lack of trust. Developers don't trust people not to pirate their software. Software users don't trust developers not to distribute trojan horses. They both have good points. Welcome to the 21st Century.

[mustmuck]

I agree with all of this. I hate the fact that PAHUD authenticates itself periodically. At least it doesn't do it all the time. On the other hand, it seems unnecessary for this software in particular (poker players are so involved with money that they'd just pay if they want to use it), and poker players have more reason than most to not want their software to be reporting to untrusted locations.

I saw somebody mention PT doing this. As far as I can see PT doesn't authenticate at all. The website insinuates that it does (they mention disabling installations if you install on over two computers), but I have seen no evidence of this. It can look to see if there is an update, but you can enable/disable this.

End result is that I begrudgingly just decided to trust the PAHUD developers. Unfortunately I think we'll see this in PT3 too.

[kidpokeher]

Stellarwind's right in all his points and the PT3 developers just told me they will be continuing this policy when it's released. This is a tipping point for me. When PT was the only thing out there I begrudgingly accepted PAHUD's policy. Now that there is competition it's time we push back.

I was planning on purchasing PT3, but if they continue to do this and Holdem Manager does not, I'll learn how to use Holdem Manager instead.

[akcbr954]

^^^^ agreed

[Mike Moon]

It would fit with some comment from the pahud developer/frontman.

Or will they just dodge/check this question.

[Tweed _Man]

[ QUOTE ]
It's why I won't steal PT/PAHUD. I am hoping "Holdem Manager" doesn't do this so I can steal it when it is ready.

[/ QUOTE ]

FYP

I'm not accusing you of being a theif, just pointing out that your average user will only really be worried about this if they have pirated/cracked software - which is exactly why I expect we will continue to see this feature on most new products.

[kidpokeher]

[ QUOTE ]
your average user will only really be worried about this if they have pirated/cracked software

[/ QUOTE ]

I'll pay for PT3 just as I paid for PT and PAHUD. I won't, however, allow programs access into my computer if it can be helped. Read Stellarwind's comments about the so-called rakeback calculator.

Others more knowledgable can comment, but it is my understanding all these so called copy protections can be circumvented anyway and that most likely includes something that connects to a registration server. Sounds to me like that was already hinted at earlier in the thread. So the only ones that are suffering a risk from some malware are the legal users and I grit my teeth every time my firewall alerts me PAHUD is transmitting info.

[PokerAce]

I started out with a registration system that didn't connect to the internet. After months of dealing with dozens of daily emails saying "I need a new code", I implemented the current system. After that, I was actually able to spend the time I used to spend generating registration codes (for new and existing users) doing something useful. It was also nice for my customers, as they could reinstall PA Hud without having to wait for me to get back to them with a new registration code.

I realize there are some people who will be paranoid and not trust an established company that has been around for years without any sort of scandalous issues. That's why we are trying to accommodate these users. See this post from the PT3 thread:

"I'm going to end this whole argument by saying we will have a system where you can be registered without PT3 connecting to the internet. HOWEVER, you will get two installs this way. After those two installs, you will need to purchase again.

An example. You buy PT3 and don't want it to connect to the registration server. You get your code (that's one). A month later, you format your computer and get another code (that's two). The next time you need to register, you will have to purchase another copy.

The reason for this is that we have no way of knowing that you didn't just install PT3 on two computers and are looking to install it on a third. The reg-server method lets us monitor this kind of thing. Therefore, the reg-server method means you can format your computer as many times as you wish on one purchase.

Therefore, people who are overly concerned about PT3 connecting to the internet get what they want, but at an added cost, due to the lack of security on our end."

Software piracy is a very real threat. I've spent a lot of time and money on piracy prevention. It's not hard to find pirated versions of software. I'm just fortunate that the hackers haven't been smart enough to figure out all of my piracy prevention methods yet, so using a pirated version of my software gives you very little benefit over using the trial version. Of course, the $25 saving isn't really worth it as you'll likely suffer from the trojan horse virus the hackers injected into their cracked version.

[freecard4all]

[ QUOTE ]
just pointing out that your average user will only really be worried about this if they have pirated/cracked software

[/ QUOTE ]
in fact it's the only situation you don't have to be worried.
I don't know why PAHUD do this but Microsoft targets "friends" with it's validation. I mean: one person buys a license and then his whole family and a bunch of friends uses this one copy of Windows.

But talking about cracks: I've never cracked anything but I think there's very little to no difference. The cracker either has to patch the routine that verifies the s/n or the routine that connects to the server.

[ QUOTE ]
it is my understanding all these so called copy protections can be circumvented anyway ... So the only ones that are suffering a risk from some malware are the legal users

[/ QUOTE ]
that's my understanding as well. The cracked version connects nowhere (although I tested only when deciding what to do so take caution as any sw can connect in some hidden way).