Search code examples
software-distribution

Safe emailing of software

Some people bought my application (which has no DRM) through PayPal. I didn't include update functionality inside the app (bad idea.) Now that there's a update, I thought I could email all previous customers with a link to the updated version they could install. Unfortunately, this idea is too open to attack (just copy and post link on forum) so it was rejected. How can I email everyone who bought the app with a safe link that is not so open to attack?
Thanks, Isaac

Solution

  • Perhaps consider this:

    • Upload an updated package to your website/ftp. Secure it.
    • Send a link to a login page to each customer
    • Each link should contain a parameter on the querystring - a GUID perhaps, for one time use.
    • Ask the user to enter their email address, and ensure that it matches the GUID you have on record for that email address.
    • Once it has been downloaded, deny any more downloads with that email address or GUID; write to a small DB (i.e. SQLite)
    • If the customer needs to download it more than once, have them email you. You can resend them a new download link with a new GUID. This would be all tied to their email address for traceability.
    • Perhaps don't even force the user to email you. Regenerate a new GUID, but cap the user at 2 or 3 auto-generated GUIDs.
    • You now have stats on who downloaded what and how many times?

    This pattern could be replicated to all the products you'd want to offer for download, and each different version. It'd be great to take advantage of this scheme for all those situations.