Theoretically, couldn't somebody make some kind of dll inject that bypassed the master server and the auth check all together? And to avoid abuse the dll could first ping the master server a couple of times to see if it's alive or not, and if it is it quits itself.