General Security Considerations

Value versus effort

There is always a decision on how tightly a system needs to be locked down. If you are protecting sensitive data, then you should always be as secure as possible. However, if you are trying to prevent people accessing paid content for free, then there is a balance between stopping a real problem and creating an expensive, over complicated solution to a problem that doesn’t really exist. It is worth taking a step back and comparing yourself to the likes of The Wall Street Journal or The Times of London, who actually have reasonably easily circumvented paywalls, and this doesn’t seem to be a problem for them.

We would recommend making it very difficult for the casual user to bypass the security, monitor the way the security works, and ensure you have the ability to tighten the security if you notice abuse. And of course tightening the security should be a server side change, not require a client side/app update! For this reason there are some steps that can be faked initially, including Securing your Content and Validating Store Receipts. 

HTTP and HTTPS, and POST vs GET

You should never compromise on HTTP POSTing (not GET) any sensitive user details via HTTPS, especially on the initial Sign In.

Limiting number of devices

There is also the option to limit the number of devices that a certain user can use. We normally advise against this as it is difficult to find a sensible number. We would rather recommend using the subscription system logs to monitor the usage from each user, and then disable any account that is clearly sharing their details with many people. If it is really important, you could try to use the sign out call to help with concurrency counting based on a user.

Protecting content on the device

This entire section is dedicated to preventing a user without access from gaining access to the content. It does NOT address how to prevent a user that has access to the content from distributing it to other users. On Android in particular, it is easy to root a device and gain access to the files on the file system. It is also easy to create a proxy to intercept the content as it is being downloaded over HTTP to get the raw files. Techniques for this involve traditional DRM, social DRM, watermarking or general obfuscation.