Sending a product key in an email to new customer

Question

I'm looking to put together the simplest online software purchasing system that could possibly work.

My plan is to allow website visitors to download the software freely from my site. The software will contain a 30 day expiry trial period, this can be removed by entering a product key.

(I know this will not stop determined hackers, I'm just looking to ensure generally honest people, will buy the software)

If the user decides they like it enough to buy, they can then simply transfer the purchase amount to a bank account, using standard internet banking.

When notification of payment is received, I would then manually send a unique product key to the customer.

My problem is that I am not overly comfortable with product keys being sent in a clear text email over the internt.

I've noticed many other small software vendors seem to use exactly this approach and don't seem to see it as a concern, so perhaps I'm being too paranoid?

On the other hand, if this is a valid concern, what other options have people used or know of, to increase the security of this final step in the process?

Would, say, creating a JPEG containing the product key and attaching it to the email be at all useful?

Answer 1

A product key is not of much value to a hacker who can probably hack your software anyway. That's the rationale behind sending cleartext product keys. That key is not tied to any really private or financial information of the customer (in any reversible way at least).

Alternatively, if the user registers for your site, you can give them the product key when they login. This has the advantage of being harder to lose.

Answer 2

In my opinion: user creates an account for your web page, purchases the product (over https), sees the authentication key (over https), logsout!

if forgets the key or somehow needs again; logins and looks it back again from web page

Answer 3

If you have the scope to enhance your application a little, I've seen a number of products that provide some kind of machine related ID that is then used to generate the product key. The installation on that machine will only validate with that one product key. This also stops users from using your software on multiple machines and sharing the software with their friends using the same product key.

Answer 4

Generally speaking, an honest user who wants to use your software wouldn't refuse to pay you because he accidentally intercepted a product key, and people who decide that they won't pay you will crack your software one way or another. So it seems to me that there's really not much to worry about.

Answer 5

Create a website where a user makes a payment and gets the product key in reverse captcha.(Product Key displayed as an image)

Benefits: Avoids copy paste of product key and circulation.

I guess its better to add the ip address or machine id/mac address as part of the encrypting text.

Answer 6

Sending clear text serial keys should not be an issue. Since you are looking for a simplest solution which would work, I think this is the way to go.

Answer 7

We have used this approach:

• Application creates a public and private key. And stores this on the system (encrypted)
• Application creates an email to us, containing the public key
• We encrypt the product-key using his public key, and send a mail back
• The encrypted key is then copy & paste into the Application, decrypted using private key

We can be certain only the requestor can read the product key.

I must admit this is a kind of special application. We provide it for free, but we need to know who uses it.

Answer 8

I suggest to use a real protection software product instead, like SoftwarePassport (previously named Armadillo). At a small cost, it will give you very robust and advanced protection system, much more robust than what you will ever build yourself.

For example, you can make your product key specific to the user hardware very easily, while still allowing the user to re-install or move to another computer (he must only deactivate the first version).

I have used it and was more than satisfied with it. It was simple, well documented and powerful.