Controlling access to my game

Question

I'm getting near the point where I'm going to be ready to release an alpha of my game. I'm curious as to how to implement a system where the game is un-launchable if a user name and password haven't been entered and verified. I plan on having an authentication server setup for verifying user credentials. I'm not concerned about making the game pirate proof, because that'll happen. I just want to make it more difficult for the casual user to share. What needs to be in place for such a system to work? My thoughts are to implement a system similar to this:

The first time the user logs in, have the users computer generate unique value based on their system attributes (not the actual attributes, I'm not collecting that). Logging in to the server sends username/pass and unique value, the server then attributes that username with that unique value and those are checked when the user logs in.

I don't plan on limiting the amount of computers a user can install on, but I want to be able to disallow obvious abuse of an account, i.e. it's being used on dozens of computers.

Is this system reasonable for a free-time sole developer? Or what kind of system would make sense for my requirements?

EDIT

Let me elaborate a little on why I want to use the system unique ID. I think that having a key like that is what would enable me to have an offline mode. I guess I wouldn't need to send the key to the server. But once a user name and password have been authenticated by the server, I can instruct the game to generate that unique ID and pair it with the user name. Then when the user tries to launch the game in offline mode, I can check to see if that computer has been authenticated online before. This would disallow people copying a verified copy of the game to a different computer to use offline mode.

Answer 1

Machine specific keys are a backwards step, they always raise customer service costs and only punish legitimate users with lockouts. It's better to suffer 10 pirates for one customer than have 9 pirates and one lost customer, in my opinion.

How about this scenario: your game ships with one missing component; when the customer authenticates his purchase your server encrypts the missing component using the hashed password and installs it. Afterwards, every time the customer plays locally he still has to enter the password and it is used to decrypt the module into memory.

Even better, non-authenticated future customers get a phony module that serves up advertisements for your other titles and/or limits their play and recommends that they register.

Your job is to create sales, not punish pirates =)

Answer 2

Why not take the Mojang approach? Once a user has registered either through the game or through your website, have a log-in screen that asks for their username and password. They your game checks the given username/pass with what is registered on your authentication server, and as long as they match then the game starts up. Why do you need to include their system specs as a key? Especially if you aren't going to limit the number of computers it can be installed on?

Of course, you would need an offline mode too. Nothing kills a game's reputation faster than not being able to play it unless you are online.