Both of these attacks are thwarted through the use of public key cryptography and access-controlled keys. You define a password for your product, take the public key that is fed back to you, and embed it into your application to pass into the license key checking API call together with the product name.