The Honest Ceiling of Offline License Verification

Originally published on lockmargin.com Last weekend I asked myself an uncomfortable question: could someone post my app and a valid license key on a torrent, and anyone use it for free? The answer is yes. That question sat with me all weekend. I couldn't build anything else until I mapped it, so this is the map. Context: I'm building LockMargin, a local-first invoicing app for freelancers. $49 once. No account. No telemetry. No phone-home of any kind. The license is a signed token the app verifies locally. The threat model First, I narrowed the problem. I'm not trying to stop professional cracking crews or commercial resellers. I'm trying to survive the casual kind: a key shared in a chat, an installer plus key on a torrent, "send me your key" between friends. Then I drew a hard line. If a mechanism breaks on a new laptop, a wiped disk, a VM - it's out. If it needs a server - out. If it needs an account - out. The app has to keep working even if my company disappears. Every option on my list had to pass that test. The honest ceiling Here is the fact most DRM marketing hides: if an application can locally answer "this token is valid," then anyone holding the same token gets the same answer. Copying the authorization is always possible when verification is local. That is not an implementation flaw. It is the architecture. Two different things get conflated here. Authenticity: did I publish this binary? Code signing answers that. Authorization: does this person own a license? A signed local token answers that. Neither prevents a buyer from handing a valid token to somebody else. And two different threats. Sharing is when a buyer gives their key to another person - the contractual and social layers help with that. Cloning is when the installer and a valid key travel together. That is where the hard limit appears: if a real installer plus a real key spreads, an offline application cannot tell the new user from the owner. I say that plainly, because pretending otherwise i