how to make a paysite ? secure and all

[tomtefan]

I need to figure out how to make a paysite. secure and all that. is it insane hard ? or easy ?


Overview: I have a music and tattoo/decal/picture site where i want to try and sell some of my work.
The layout is very simple. you have the music or pictures out on the screen in rows.
And under each one there is a price info and a Buy option.

Looks like: (you have to imagine a nice picture here, where text is right under it)
_____________
| picture |
| here |
|_____________|
price:1e Buy

When you hit the Buy button, it should put that picture ID into the "buy basket".
Where you can then overlook what you are about to buy.

When you buy, you fill in the different needed fields.
and the items you have bought are automatically downloaded.



I can build the site and such, thats not to hard. have similar things in my game.
But, how can i make the paysite, where they will enter cred number and such totaly safe and secure. ?

and i think its best if i have options like: visa, mastercard <-- and those normaly used.
aswell as paypal.

and to make the things they bought to automacitally pop up a download box.
Or perhaps its better to let them first buy the things, and then go to a download window ?


I hope someone of you all can direct me somewhere. but best if anyone here KNOWS how too.



And while iam on it, donations ? (want that for my game wich will be free).
is that working in the same way ? (think it is). and how dows that work. ?


To HALLSOFVALHALLA: I saw the donation button you have, have you made the template yourself,
or did you get that from somewhere ??

Oh, and, halls again, do you have some sort of icon link thingy ? wich i can put in my Link stuff. ?
As iam getting help from this cool community, i want to try and help in return.


I have no idea where to even start about the pay thingy stuffs...

[Chris]

Web shops are simple to make. Specially if you just integrate PayPal or such into it. They do all the hard work for you. All you need to do is provide the goods, make a simple cart script and integrate the PayPal API which comes with a really user-friendly documentation.

Visa and Master Card should come with API's as well. I've never used them before but I'm sure it's really straight forward.

One problem about making an music shop is securing the files. You'll have to email the music as an attachment rather than letting them download it straight from one of your servers.

[Jackolantern]

Definitely go with Paypal or another payment service instead of doing it on your own. There is a lot of legal responsibility to doing it yourself, and unless you are extremely versed in web security, there will be holes in your system just waiting for someone to come along and cause life-changing havoc.

[tomtefan]

ok, ty.

i checked out paypal, it looks easy to use.

gonna try and fix it.

[kaos78414]

One problem about making an music shop is securing the files. You'll have to email the music as an attachment rather than letting them download it straight from one of your servers.

Why is that? Emailing the file is just as much work for the server as allowing the user to download it.

I would just write a script that creates a random string

Code: Select all

//Generate random string
	function generate_random_string($minLength = 5, $maxLength = 5, $useUpper = true, $useNumbers = true, $useSpecial = false)
    {
        $charset = "abcdefghijklmnopqrstuvwxyz";
        if ($useUpper)
            $charset .= "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
        if ($useNumbers)
            $charset .= "0123456789";
        if ($useSpecial)
            $charset .= "~@#$%^*()_+-={}|][";

        $length = mt_rand($minLength, $maxLength);
        if ($minLength > $maxLength)
            $length = mt_rand($maxLength, $minLength);

        $key = '';
        for ($i = 0; $i < $length; $i++)
            $key .= $charset[(mt_rand(0, (strlen($charset)-1)))];

        return $key;
    }

Then stores that string in the DB, along with the users email or some other user information. Then it could email that person the download link and validate via the generated string.

So the URL would be like site.com/download/track_number/random_string

And if the email in the session matches the row with the random string in the DB, then the download would start, otherwise it would return a 404 or some other error. (I'll let you figure that out )

I'm pretty sure that'd be all you need to make the file download relatively secure. I mean you can prevent directory access with just an index.html file or .htaccess.

[Chris]

One problem about making an music shop is securing the files. You'll have to email the music as an attachment rather than letting them download it straight from one of your servers.

Why is that? Emailing the file is just as much work for the server as allowing the user to download it.

I would just write a script that creates a random string

Code: Select all

//Generate random string
	function generate_random_string($minLength = 5, $maxLength = 5, $useUpper = true, $useNumbers = true, $useSpecial = false)
    {
        $charset = "abcdefghijklmnopqrstuvwxyz";
        if ($useUpper)
            $charset .= "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
        if ($useNumbers)
            $charset .= "0123456789";
        if ($useSpecial)
            $charset .= "~@#$%^*()_+-={}|][";

        $length = mt_rand($minLength, $maxLength);
        if ($minLength > $maxLength)
            $length = mt_rand($maxLength, $minLength);

        $key = '';
        for ($i = 0; $i < $length; $i++)
            $key .= $charset[(mt_rand(0, (strlen($charset)-1)))];

        return $key;
    }

Then stores that string in the DB, along with the users email or some other user information. Then it could email that person the download link and validate via the generated string.

So the URL would be like site.com/download/track_number/random_string

And if the email in the session matches the row with the random string in the DB, then the download would start, otherwise it would return a 404 or some other error. (I'll let you figure that out )

I'm pretty sure that'd be all you need to make the file download relatively secure. I mean you can prevent directory access with just an index.html file or .htaccess.

It's a good idea but there are flaws.

There are complex ways around that method using session and string generators to attack servers. The file will also still be on a part of the server that will have to be remotely accessible.

[Jackolantern]

There must be some accepted loss in these types of business models, because pretty much every pay-per-download service offers the data as a download after payment is made. So I don't know, maybe they just accept that there will be a small percentage of downloads that are not legit? Depending on how much security you can put it place, it may be an acceptable loss compared to making users go through an atypical purchase procedure.

[kaos78414]

I'd probably be more worried about someone who buys it putting it up on a P2P service like Frostwire. But meh, like Jackolantern said, it's tough to keep all the theft from happening without sacrificing alot of usability and thereby alienating your buyers to begin with.

[Chris]

Yeah it actually surprised me what some Russian kids can come up with. At my work we have a good 300 odd servers all running custom built software for companies. The other day we found out that one of the servers that runs its very own custom built applications for video streaming through mobile networks was being breached by some Russian servers. Turns out they had downloaded a good 100 gigs worth of encoded video files recorded by cameras on police cars. We're curious to know how they even knew about the servers. But more so how they even got into and made use of the custom built Operating System we use on the server. Just hope they didn't get their hands onto our decoder.

The problem is there are too many people in the world. And some how some are smart enough to figure things out others can't even fathom. Another problem being some of these people like to be a nuisance and come up with pretty clever viruses and simply painful programs.

True digital security will never be made possible.