3

For a website, there is a free and a paid membership option. Once the user pays some amount he gets a membership for a month for additional products that are not in the free account on the website.

Now once the user pays and gets a membership, how to make sure that only one user accesses the account ? I just want that only one user should use a paid account and even if he gives the set of Email ID and password to his friends, they shouldn't be able to login.

So what do I need to do for this ? There are many sites that offer paid membership options. Do they do anything special to restict one user per paid account ?

Improve this question
8
  • Presumably if paid-user gives his Email ID and password to his friend then the friend can only login to the paid-user's account? I'm just curious as to where that would be a problem? Are you protecting access to information?
    – MrWhite
    Commented Jan 19, 2013 at 11:11
  • 1
    @w3d ... yes. protecting access to information and content that the paid user gets. On the website a paid user can get last 10 years question papers of 10th grade examination along with solutions. Now if a student from a particular class gets a paid account, I don't want that his/her classmates can also get access to the question papers along with solutuions without paying. Because people studying in same class will surely try to access the paid feature once the ID and password gets dirstributes among friends.
    – Asutosh Panda
    Commented Jan 19, 2013 at 12:07
  • Is there anything stopping a paid user from downloading the information and distributing it outside of your website?
    – MrWhite
    Commented Jan 19, 2013 at 13:08
  • @w3d .. Yes. It cannot be downloaded. Flash reader that cannot be downloaded.
    – Asutosh Panda
    Commented Jan 19, 2013 at 14:05
  • If it can be viewed, it can be downloaded. Flash is no exception.
    – Free Radical
    Commented Jan 19, 2013 at 14:33

2 Answers 2

Reset to default
4

There is no simple solution to this problem. Static passwords may be shared among friends. Tracking mechanisms (IP-addresses, cookies) will turn up "false positives" (i.e. rejecting real paying members) - which is very bad for business.

Using a OTP (One Time Password), as suggested by Steve, is probably not practical, as it does not allow casual use, and is easily bypassed (the user can pass on the one-time password to the friend by SMS forwarding or even voice).

My proposal (if you think that discouraging sharing is a good idea - it may not be a good idea - read the last paragraph), is the following:

Provide an EULA where you make it clear that sharing the password with friends is not allowed and will result in immediate loss of access. This should discourage sharing, since the member will jeopardize his or her own invenstment by sharing the password. Unfortunately, it is not easy to actually discover sharing (you can't rely on cookies or IP-addresses). However, non-technical users will not know that. One pretty robust indicator that the password has been shared if there a two (or more) simultaneous active sessions with different IP-addresses - so you may even be able to catch some that violates this policy.

To discourage sharing of the downloaded documents, you may only allow users to download a non-volatile document format (e.g. "protected" PDF), and put a visible watermark on each page with the user's identity. If "shared" documents are leaked on the Internet, you will know who to blame. Again, the idea is to make it clear to users that it is possible for you to learn about policy violations. (You may also try to not allow downloads, but this is not really practical - if it can be displayed, it can be downloaded.)

In addition to the above, you may use third-party authentication with an authenticator provider that does not provide disposable identities (e.g. Google Authenticator). Users will be more reluctant to give friends access to such an identity, since a Google identity (for example) "at large" may harm the owner of that identity if it gets in the wrong hands. (It is possible to create a "disposable" identity with most of these third party schemes - but to do so requires skill and some knowledge.)

However, the plain truth is that it is impossible to protect information behind a pay-wall from being shared.

Whatever you do, someone can pay access, login once, and download all that is available (it may be one work, or it may be your entire database - depending upon your pricing/access scheme. And when something has been downloaded, it can afterwards be shared with friends, classmates - or the entire world.

The publishing and music industry as been looking for a solution for this for ages. They call it "DRM", and the truth is that it does not work. The most successful strategy is probably not to worry about sharing. Instead, put your efforts into making your product attractive, and the majority of your paying customers so loyal that they do not want to scam you. This essay by Tim O'Reilly is recommended reading for aynyone asking the type of question you ask: https://plus.google.com/+TimOReilly/posts/BEDukdz2B1r

Improve this answer
5
  • Thank you. This problems is more complex than what it seems. But still I have found a way out. Hope it works. Charging per login session? For eg- some amount of money for 100 login sessions into the account. One login session = logging in and logging out once. On the website we have last 10 years questions of 10th grade national level examinations along with solution. Once logged in, it will raise the counter as 1. Accordingly for number of times you login. I can restrict it for let us say upto 100 times.
    – Asutosh Panda
    Commented Jan 19, 2013 at 14:14
  • How are you going to stop a single user buying login, logging in, download all the material on the site, logging out - and then forwarding all the material downloaded to his classmates?
    – Free Radical
    Commented Jan 19, 2013 at 14:18
  • 1. No-one can download from a flash reader. 2. We cannot stop users from giving his password to his friend but a fear may arise when he gives his password to some one, the amount of login session that he has given money for get utilized and it increases..
    – Asutosh Panda
    Commented Jan 19, 2013 at 14:28
  • How to download flash: voices.yahoo.com/…
    – Free Radical
    Commented Jan 19, 2013 at 14:35
  • Then I can hope only by putting a EULA and make users beleive that they should not pass it on
    – Asutosh Panda
    Commented Jan 19, 2013 at 14:44
2

It is pretty difficult to implement something like this. You can't do it based on IP number because most people have dynamic IP. Even if it was only some people, you would have a problem.

You could do it via a cookie, but I reckon you are creating a support nightmare for yourself as some people don't accept cookies, people delete cookies. Besides, what is to stop the person who is using someone else's email saying "I deleted all my cookies".

If you wanted to you could send an SMS with a unique password each time someone logs in...but good luck with people enjoying that experience, because they won't.

It is like with software, music, just about anything, there will always be a percentage of people who will scam the system.

Improve this answer
5
  • 1
    then how about charging per login session? For eg- some amount of money for 100 login sessions into the account. One login session = logging in and logging out once. What do you feel on this option ?? On the website a paid user can get last 10 years question papers of 10th grade examination along with solutions. Now if a student from a particular class gets a paid account, I don't want that his/her classmates can also get access to the question papers along with solutuions without paying.
    – Asutosh Panda
    Commented Jan 19, 2013 at 12:11
  • @user1439968: Would you limit the length of a login-session? A few hours, a day?
    – MrWhite
    Commented Jan 19, 2013 at 13:15
  • I think that is not important. So I'm not putting any constarint on how many hours does one login session consists of. The counter is raised as one, when logged in once. Now if the users closes the browser without logging out, destroy the session.
    – Asutosh Panda
    Commented Jan 19, 2013 at 14:22
  • But I'm caught in one more situation. There is no way that a content cannot be downloaded. Once downloaded, we have no check to where it goes. So the only thing I can do is to put an EULA, making it clear that sharing the password with friends is not allowed and will result in immediate loss of access. And can only hope that the wprst doesn't happen.
    – Asutosh Panda
    Commented Jan 19, 2013 at 14:58
  • Just a comment regarding logging out and session length... If users are charged per login, then they might choose not to close their browser? Must admit I'm in the (bad) habit of leaving my machine on 24/7 and only closing my browser every few weeks. The other thing to be aware of is a change in behaviour of Google Chrome since version 19. Chrome no longer deletes session cookies if the user has set "Continue where I left off" - it attempts to resume sessions whenever possible!
    – MrWhite
    Commented Jan 19, 2013 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.