Why are Windows 95 installation disks not uniquely bound to a single product key?

Question

I was installing the OEM version of Windows 95 on VirtualBox the other day for reminiscence sake, and for some reason I had two different product keys. I tested both of them to see which one mapped to the CD, and to my surprise both product keys work with the installation. I always thought the product key and CD were one-to-one, but is this not so with Windows 95?

Answer 1

The CD media for OSR (OEM Service Releases) are generally all the same; there is no unique code on the disc. Imagine what a problem this would be for commercial users with multiple machines to support - they wouldn't want to archive multiple copies of the media.

Making the key unique to the disk doesn't add any protection if the disc image is easily writable (unless there is online checking to limit reuse of codes)

Answer 2

CDs are made by pressing, having a new master made is expensive so the content of the disk would rarely be changed, certainly not for a single copy.

Yes there are recordable CDs now but they were not common at the time windows 95 was released, cost more in bulk than pressing and generally have worse longevity.

Even for media that is not pressed making a load of identical copies is simpler than uniqely serialising disks.

I guess this was a large part of the motivation for having product keys in the first place, to allow a copy sold to be uniquely identified even though it was shipped on bulk-copied media.

Answer 3

MSDN always uses the key 335-XXXXXX6 for legacy software which works for old visual studio & windows 95/98 editions. I just checked and VB6 still has the same key.

I don't think I ever remember typing other key back at the time (and don't forget internet access was a very new thing) I don't remember if it even came with a SLIP/PPP driver at the time.

Answer 4

Microsoft's licensing and activation functions have slowly evolved over time. When Windows 95 and then Windows 98 came out, Microsoft used keys that were unique but not tracked via a central database.

When Windows 95 was first introduced, at that time access to the Internet was still very uncommon, with people using 14.4 kilobit in about 1994 or so. All computers could not be guaranteed to have modems to call in to a licensing registry, and Ethernet was uncommon except in schools and businesses. So how would the software be able to easily know if a product key was being uniquely entered for each installation?

 

Typically in the old days, the way that install software would become activated involved using install media that could be written to. There would be some sort of key disk that would have activation information written to it, and was designed to use copy protection to prevent duplication and transfer of the software to someone else. If this disk was damaged or unreadable then then software could not be used anymore. Typically this type of software protection is only used infrequently.

If Microsoft had done this, the key disk would have had to be permanently inserted at all times, preventing use of the floppy drive, which would have been both cumbersome and annoying to Windows users.

 

The modern activation process is not specifically tied to the software installation disc, but rather to your hardware.

Most modern standardized Windows install media can be used an unlimited number of times, but requires a unique product key for each installation. The product keys themselves are tied to hardware inside the computer, commonly the MAC address of the network interface, which every modern computer now includes integrated by default.

For modern Windows installations that include Windows preinstalled and no product activation is needed, that is a special short-run customized installation media used by a vendor for all their products. That install media is not uniquely tied to that specific computer, but will work for any similar system from the same product family.

Answer 5

CD distribution media is difficult/expensive to make unique. I once worked on a very low-volume product. We devised a technique to make the CD "proof of purchase" i.e. baked the product key into a unique CD which could not be copied.

What we did:

Our technique relied on burning a writable CD and then making a small scratch on the label side at a fairly specific radial distance. The CD distribution included one huge file which contained nothing more than the product key in a specific encoding and pattern. The scratch rendered some portion of this file unreadable. The installation process would read this file and expect to find it mostly readable with the correct data pattern, and some portion unreadable. If the file met this criteria, it would accept the CD and register the installed software with the license key encoded in the file. Any attempt to copy the CD would fail because of the damaged file.

What was wrong with our technique:

The technique itself worked well. We could reliably produce a CD that could not be copied and was proof of purchase. It worked for our low-volume product (a few dozen copies), might have been sustainable for hundreds of copies, but impractical for larger distributions because each CD had a one-off generated license file which took time to generate and even longer to burn the distribution onto the CD. Typical CD distributions involve a CD master which is pressed in the same way as vinyl records; each CD is identical.

Bottom line: while it is possible to bind a product key to a specific key (we demonstrated one way to do it), it isn't practical or economic to do for anything published in volume, especially not on the scale of an O/S.