IP Restrictions

Truss

Creating a website where you log in and download things - all legit don't worry - the only thing is doing it this way there's nothing stopping you giving your mate your username and password and logging in that way.

I had heard of some way of creating a unique IP subscription, so that whereever you creat your account and download the materials from first is the only place you can download them from when logging in, that way your mate has to come over everytime they want something - I know your mate could just ask you to get whatever you want from the site but not a whole lot I can do about that, its more to prevent people who don't know each other that well preventing them spreading the username/password.

Can this be done? Are there drawbacks? Can someones IP address change without them knowing it and then they get locked out?

leeroybrown

You should be able to do this but there are drawbacks. Most standard home internet users get their IP address from a DHCP pool meaning that their IP can (and will) change over time. Many networks will use a NAT setup where all Internet requests from within the network appear to come from the same IP. Many larger networks will use proxy servers where all HTTP(S) traffic will come from the same IP address. A good example would be that every student in a large university might appear to have the same IP address as far as you're concerned.

If you still want to go down this route then you'll have to consider including a feature where the account holder gets informed about their IP change on your site and given the option to do an e-mail based confirmation to change their registered IP. It sounds quite fiddly to me and it still won't prevent account sharing within a network in many cases.

ttm

Only thing you can do really is check that two users aren't logged in with the same password at the same time.

MOH

What about an IP limit per downloaded item per account?

Each account can download each item as many times as they like to the same IP, but if they try to download again from a different IP they have to go through leeroybrown's e-mail confirmation.

If they're downloading a new item for the first time, doesn't matter if their IP is different to what they used before, as long as that IP is consistently used for downloads.

Drawback is it won't work if it's the kind of thing where one person might be interested in half the catalogue and their mate in the rest.

Maybe as an added check, if they've downloaded some stuff with IP#1, then more with IP#2, then try to download again with IP#1, chances are they're sharing the account, assuming the address pool is large enough that they're unlikely to be randomly assigned their previous IP again.

cpu-dude

Truss wrote: »

Creating a website where you log in and download things - all legit don't worry - the only thing is doing it this way there's nothing stopping you giving your mate your username and password and logging in that way.

I had heard of some way of creating a unique IP subscription, so that whereever you creat your account and download the materials from first is the only place you can download them from when logging in, that way your mate has to come over everytime they want something - I know your mate could just ask you to get whatever you want from the site but not a whole lot I can do about that, its more to prevent people who don't know each other that well preventing them spreading the username/password.

Can this be done? Are there drawbacks? Can someones IP address change without them knowing it and then they get locked out?

Blocking or limiting IP addresses won't work. Limiting it to IP just won't work because of the abundance of DSL providers (with DHCP).

There is no difference between person A downloading 50 things and person A and B downloading 25 things each. What I might suggest is some sort of implementation to prevent downloading the same file within a 7 day period... that way, individual file sharing technically cannot happen, other files could obviously be downloaded but not the same ones.

By the way, why don't you want another person using the same username? Is this a pay service?

Truss

Yeah it's a pay service - it's actually really cheap too (around €15) for one year for something that will take over well 500 hours of work to create the data - competitors are charging up to 6 times this - I was actually thinking that if it was too cheap people wouldn't mind giving their username to their mate, whereas if it was actually more expensive they'd be more inclinded to not give it away so easily...anyone know of the psychology of this sort of strategy?

cpu-dude

Truss wrote: »

Yeah it's a pay service - it's actually really cheap too (around €15) for one year for something that will take over well 500 hours of work to create the data - competitors are charging up to 6 times this - I was actually thinking that if it was too cheap people wouldn't mind giving their username to their mate, whereas if it was actually more expensive they'd be more inclinded to not give it away so easily...anyone know of the psychology of this sort of strategy?

There always a chance that people will share their username and password. In this case you should have a usage limit, this way people won't be as inclined to share credentials.

Alternatively, if it's cheaper than the competition, more people should sign up so no need to share the account.

ntlbell

Truss wrote: »

Yeah it's a pay service - it's actually really cheap too (around €15) for one year for something that will take over well 500 hours of work to create the data - competitors are charging up to 6 times this - I was actually thinking that if it was too cheap people wouldn't mind giving their username to their mate, whereas if it was actually more expensive they'd be more inclinded to not give it away so easily...anyone know of the psychology of this sort of strategy?

why would n't that one person just download it and then give the data to their mate?

tricky D

cpu-dude wrote: »

What I might suggest is some sort of implementation to prevent downloading the same file within a 7 day period... that way, individual file sharing technically cannot happen, other files could obviously be downloaded but not the same ones.

Then there's the problem of knowing whether the download was successful. The download request does not imply a successful download. Or are there ways to verify successful download that I'm not aware of?

cpu-dude

tricky D wrote: »

Then there's the problem of knowing whether the download was successful. The download request does not imply a successful download. Or are there ways to verify successful download that I'm not aware of?

Good point, not unless a Java downloader like Microsoft and Adobe use was implemented... they can also be paused which is a useful tool for a downloading website.

Truss

It seems to be a case of just trust, I could offer what I'm creating through print-off and post that way you'd only be buying what you want therefore less chance of your mate needing exactly what you've bought but it's not a business that I intend on living off and not one I want to be running to the post office every day sending things off, it's more of an earner on the side...

Might just have to trust the good folk of the world...(I hear them all laughing now...)