Preventing Sharing of User Licenses
Hey everyone,
I have a new SaaS application that’s quite niche. The problem I am having is I want to prevent one person from buying a license and sharing it with their peers to use the service. I know this is a struggle. I’m a PHP developer so I can figure out the technical side of it, but I’m trying to think of creative ways of limiting users who pay for the service who of course have access to the features but abusing the system by allowing their coworkers to access the tool as well.
Any thoughts or ideas?
Thanks!
Don't try to lock users out if they login or use the app from more than one computer. You will invariably end up punishing users that are doing nothing wrong. This is worse than people abusing your licenses. Instead, soft track it in a way that helps you understand user behavior but doesn't let the user know that you know they are cheating.
Once you have your tracking in place and you know your bad actors, find features that would cause them to voluntarily stop their behavior. Most of these will involve either security (I don't want another employee seeing this when they login with my account) or collaboration (I want to share with another employee and see their activities separate from my own).
Measure how your feature release reduces license abuse and remember that license abuse is the least of your worries! If people are sharing credentials to use your services then you are on to something. Don't f it up by slapping them in the face!
Hi Javier! Thanks for your comment.
This is an aspect I can respect. However, my userbase is quite small, so the license abuse is one of my biggest worries. I will certainly keep this in the back of my mind though.
Do you have a tracking mechanism in place already then? If so what is it using to identify license abuse?
Well right now, I'm setting up limiting it to one session per IP so when that account logs in via another browser or computer. Not the ideal way, but that's why I'm here to ask :)
What evidence do you have that this is a problem then? You could be spending time and irritating users to stop something that was never happening in the first place? Obviously it's your business and your decision but I really think you should consider alternatives.
I only say this because I had the same feelings when I started my first business in the early 2000s. We grew it to 30M in revenue and sold it for 130M and we never saw license abuse even though it would have been easy for our customers to do so.
You could be spending your valuable time on product market fit or user acquisition...
Great question. My co-founder is a lawyer and in his firm (43 lawyers), they have software that they pay for 5 user licenses and share it between all of the lawyers. He thinks that they would do the same for this.
Measurements are still the way to go. Especially with lawyers. let them abuse it and build a bunch of evidence. Then go Oracle on them and tell them they've been violating their license and need to "true up". This approach is better than locking them out in the first place because it gives you a venue to have a conversation and also let's them get nice and addicted, not annoyed
I laughed hard on the "Then go Oracle on them" :'D
Thanks I appreciate this insight, I'll give it a try.
There's plenty of examples where there are thousands of unique users behind one IP. For example with carrier grade NAT. Limiting to one session per IP means that you are also limiting those users.
Focus on improving your product, not on how-to limit use.
The easiest way to track would just monitor cross session activity on the same user account. So if you have session A and session B active on the account and then see activity on session A after session B is created then you have license abuse. IP based tracking is one of the worst approaches to this due to DHCP and NAT.
If you are tracking IP's, then you are implying that you not only have different people but that they are in different networks. This is very unhandy for working environments, since most employees will share a common IP. If you are so niche, I assume that would be the case.
This means that what you have measured as license violations could be much bigger than what you thought.
If you have users that enjoy your product so much that they are willing to share a username, it could mean different things. For instance, you could be overpriced. Or you are trying to sell to end users while you should be targeting businesses. Basically, you could go B2B instead of B2C.
Is the license violation making you lose money? Or is just lost opportunity?
Lose money. We have to do the same amount of work and server load is higher just with less paying users because people are sharing.
A lot of users are on corporate networks so yeah that’s one IP.
I just don’t know what to do.
Charge more and voilà.
In my experience, efforts to clamp down on this behavior end up driving good customers away.
I once did consulting work for a $2 billion SaaS company that priced their solution per seat. For about four years, even though they tracked shared licenses, they did nothing about it - because it didn't matter.
Their entire pitch was that the tool could be used to run your business, and a lot of the features required named logins and individual user accounts. But for customers that tried circumventing that, they'd rather have the limited licensing revenue than antagonizing a potential upsell.
And that did happen, frequently: Customers would agree to 1-2 licenses, share that between 6-7 people for a year, and when the contract renewal negotiations came up, those stats would be pulled up and referenced. Most of the time, the salespeople could close an upsell at that point.
If they just locked people out for a year, that would have soured the relationship and cost more revenue than they otherwise "lost" through the sharing.
I have a similar 'problem', don't fix it.
You have engaged users that like the product so much they share it. Instead of wasting time limiting users that find your product valuable, reach out to understand how they use the product and what makes it valuable for them, then use that knowledge to improve your product and grow your userbase.
What is the material impact of this 'issue' for you? Any effort in preventing this, takes time for more valuable activities and makes your solution overall much more complex. You can always worry about this later.
Edit: if needed, just detect the users manually and reach out to them so they can upgrade. Don't add technical limitations at first.
Hi Reinder,
Thanks for your reply. The problem is, my userbase is limited. Roughly 1,000 people. It'll grow / vary over time but that's my basic userbase. It's a great product and many of the industry leaders have said the idea is good and are ready to pay but they will only pay X amount. The other workers in this industry are also notoriously cheap. So my issue is, if I don't fix the 'problem' my income is limited for hard work and a genuinely good product.
It's on-going work too, so if I get say 50 people paying ($75/m x 50 = $3,750/m) and 200 people sharing their logins ($75/m x 200 = $15,000/m), not great for me right? Lots of money left on the table and kind of a bummer that they want/need my product but aren't willing to fork up the dough simply because they 'can' abuse it.
I totally get your point of view. If I was in a market of tens of thousands or hundreds of thousands, I'd be more open to just focusing on other things.
Thanks again.
I understand your point but I think with such a small user base it is even more important to understand why they are doing this and what is preventing them from signing up more users.
Your problem is not that they are sharing accounts, it is that your users don't want to pay for these accounts, so they might not see the value.
In the end you need to understand how much money you need to make out of this 1k user group. Then you should check if this is feasible.
Does everyone share their account? If so would a different pricing model not work better? Add a team price of $299/month for a team and let them share accounts for example.
You could also enable 2FA by default using a phone number, that way the original user need to hand out 2FA tokens constantly, which might be annoying enough to start signing up more people.
I can think of a couple ways to approach this problem.
Wouldn't websocket connection gets established for each new tab browsing the same url/app?
That's a very good point. If you don't want your tabs to knock each other offline, you would need some indication that another tab is active. I.e. something involving local storage, cookies, or a service worker. Maybe an authentication session based approach is simpler
Yes, this is in line with some of the other comments, I think that's the way I need to go. Websockets.
This comment was deleted 8 years ago
This comment was deleted 7 years ago
Hey Thomason,
That’s a great idea. I can do that. The main users will be lawyers in law firms so would that network show only one IP ago the outside world thus allowing multiple users to login from that single IP?
It’s not customer specific data, it’s access to formatted data that’s updated in real time. So one user may use it, then when he’s done he could pass it on to his coworker and let him use it and so on. There may be times when they overlap and this tactic can work but I can see them trying this to save money.
I like the idea though and will implement it anyway. If you have another suggestion after this information I’d love to hear it. Really appreciate your time and insight.
This comment was deleted 7 years ago
I'm not sure what corporate networks look like, but in a basic network setup, doesn't every computer share the IP of the router? Everyone is behind NAT
If they are in the same office they will almost definitely have the same ip.
Are you expecting people to switch devices regularly? If not you could just invalidate all the sessions of a user every time they login. So only the user that logged in last would have a valid session.
"If not you could just invalidate all the sessions of a user every time they login. So only the user that logged in last would have a valid session."
Yeah, this is looking like a good solution. They need to be logged in to view the content, so when they change pages, they'll be logged out should anyone else log in.
This comment was deleted 7 years ago
That is true, but there are so many devices on the internet that we made it more complicated ☹️ and secure 😊 by using Network Address Translation aka NAT. https://en.m.wikipedia.org/wiki/Network_address_translation The problem is further complicated by the fact that both IPv4 (what is used in the video) and IPv6 exist. IPv6 IP addresses look like 2001:0db8:85a3:0000:0000:8a2e:0370:7334. If you have your phone and your computer on the same WiFi at home, they each have different IP addresses within your home. Here is how you can check if your devices are using IPv4 to go to the internet. Google "what is my IP" on both of those devices. If your devices are using IPv4, they will have the same IP address according to Google! This is because ipv4 uses NAT, therefore Google only ever sees the IP of your router. If you have IPv6, then they probably have different IP addresses.
This comment was deleted 7 years ago