Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #11678

Re: Secure website

Show all headers | View raw

On 10/31/2013 12:47 PM, Graham Hobbs wrote:
> On Thu, 31 Oct 2013 11:24:25 -0400, Jerry Stuckle
> <jstucklex@attglobal.net> wrote:
>
>> On 10/31/2013 10:27 AM, Graham Hobbs wrote:
>>> On Wed, 30 Oct 2013 23:03:42 -0400, Jerry Stuckle
>>> <jstucklex@attglobal.net> wrote:
>>>
>>>> On 10/30/2013 7:15 PM, Graham Hobbs wrote:
>>>>> On Wed, 30 Oct 2013 14:56:12 -0400, Jerry Stuckle
>>>>> <jstucklex@attglobal.net> wrote:
>>>>>
>>>>>> On 10/29/2013 11:02 PM, Graham Hobbs wrote:
>>>>>>> Hellop,
>>>>>>>
>>>>>>> I have an ordinary website (all PHP), it has no 'conscious'
>>>>>>> protections, just code that does a job. One page (not written yet
>>>>>>> because I don't know how), will advertise a product for sale.
>>>>>>>
>>>>>>> My concept is that a buyer goes to a paypal screen, does the
>>>>>>> necessary, when payment is verfified and paid, an email is
>>>>>>> automatically sent to the buyer with a download key. At the buyers
>>>>>>> dicretion, they go to the download page, enter the key and the
>>>>>>> software gets downloaded. Is this sort of thing a novice PHP'er could
>>>>>>> do.
>>>>>>>
>>>>>>> I'd like to be sort of semi-conversant before I contact paypal. Is the
>>>>>>> above feasible, is my ordinary website secure, is there a specific set
>>>>>>> of PHP'ish or other 'things to do'
>>>>>>> e.g.
>>>>>>> ... how to prevent more than one download, do I store the software
>>>>>>> package on my ISP's server, is it safe, since it has several exe files
>>>>>>> would they be in a zip file, how to assign a download key, let the
>>>>>>> whole process be automated?
>>>>>>>
>>>>>>> .. starter clues appreciated, thanks,
>>>>>>>
>>>>>>> Graham Hobbs
>>>>>>>
>>>>>>
>>>>>> A couple of questions:
>>>>>>
>>>>>> 1. What happens if that "one download" is unsuccessful?  Are you going
>>>>>> to make the buyer pay again?
>>>>> - OF COURSE .. just a joke!
>>>>> - I would guess a failed download would be rare but if so, an email
>>>>> would ensue and |'d reply with an attachment - reasonable?
>>>>
>>>> Less rare than you would think.  And how would you check to see if the
>>>> download failed or not?
>>> I wouldn't, I'd expect an email from the buyer. Is there a rule of
>>> thumb way to check?
>>
>> No, there is no good way to check to see if a download completed or not.
>>   The file may have been sent, for instance, but for some reason not
>> stored on the user's computer (i.e. internet connection broke, out of
>> disk space, etc.).
>>
>> But expecting an email from the buyer after he/she purchased something
>> isn't very user friendly.  That's why most products use unique keys
>> which must be keyed into the product to make it run.  But of course that
>> only works if the user has a reason to contact your site again, i.e.
>> upgrades, etc.
>>
>> If your audience is so small, why not give them a download link which is
>> good for something like 24 hours?  That way if it fails, they can retry.
>>
>>>>
>>>>>>
>>>>>> 2. What is to stop one person from buying your program, then sending it
>>>>>> off to all of his friends (or uploading it to another site)?
>>>>> - doesn't all software face that problem? .. is there a solution?
>>> Would be most interested in commentary on this.
>>>>>>
>>>>>> You can do it, but in addition to the other comments about PayPal - if
>>>>>> they have a system outage, it can take several hours (even after they
>>>>>> make it back up) for them to process the payment.  It doesn't happen
>>>>>> often, but it does occur.
>>>>> - my software has a small audience, I would expect this not to be a
>>>>> concern
>>>>>
>>>>
>>>> Famous last words...
>>>>
>>>> If your audience is so small, why do you worry about it?
>>> Well I hope 'not SO small':-). Am not worried. Given the small number
>>> of buy operations and infrequency of Paypal downtime, concurrency of
>>> these events would be remote.
>>> But I do worry about some nasty intercepting and cocking up any part
>>> of the process from 'the buy page' through to emailing a 'key' and the
>>> subsequent download. Not infecting buyers is the point.
>>>
>>
>> You can take standard security precautions on your website, but there
>> isn't much you can do about email being intercepted.
> ---
> That's good notes Jerry, thanks,
> I googled 'standard security precautions for websites' .. got to a
> company called Webroot (amongst others) .. they list a slew of things
> they take care of .. might be a reasonable approach for me? I can't
> see me programming 'security' myself, best left to the experts.
> Graham
>

Depends on how much you're willing to pay, and how much you trust the 
qualifications of the programmers.  Anyone can "list a slew of 
things...".  Fewer can do it properly.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-29 23:02 -0400
  Re: Secure website Denis McMahon <denismfmcmahon@gmail.com> - 2013-10-30 03:26 +0000
  Re: Secure website "J.O. Aho" <user@example.net> - 2013-10-30 06:52 +0100
    Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-30 10:47 -0400
      Re: Secure website "J.O. Aho" <user@example.net> - 2013-10-30 18:03 +0100
        Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-30 19:18 -0400
  Re: Secure website Jerry Stuckle <jstucklex@attglobal.net> - 2013-10-30 14:56 -0400
    Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-30 19:15 -0400
      Re: Secure website Jerry Stuckle <jstucklex@attglobal.net> - 2013-10-30 23:03 -0400
        Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-31 10:27 -0400
          Re: Secure website Jerry Stuckle <jstucklex@attglobal.net> - 2013-10-31 11:24 -0400
            Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-31 12:47 -0400
              Re: Secure website Jerry Stuckle <jstucklex@attglobal.net> - 2013-10-31 20:36 -0400
  Re: Secure website David Quinton <usenet_2005D_email@REMOVETHISBITbizorg.co.uk> - 2013-10-31 10:24 +0000
    Re: Secure website Graham Hobbs <ghobbs@cdpwise.net> - 2013-10-31 10:28 -0400

csiph-web