I'm building a chrome extension that I would like to offer for free for a given trial period and then the users buys a registration key on our website for a forever version .

I've built software previously, but I've never made something paid.

Using my basic knowledge of cryptography and membership websites, I thought of the following :

  • When the user installs the extension for the first time it create a variable for the registration key with an empty value, which means that the user hasn't bought the product yet and they are in a trial period.

  • Once the user opens the extension it will check if the trial period has ended by doing date computations .

  • If the trial has ended the user will have a form for his email and registration code.

  • The user buys the registration code on our website. We process payments via stripe, and as a callback the server will create a hashed key based on their email . It will also hash a string based on the browser ID they're using to make sure that the paid version works only on one platform. After that it will save all those hashed keys in a DB by email.

  • The registration code is sent to the user via email

  • The user can now reopen the extension and enter their email + registration code . The extension send an Ajax request to the server with the entered mail and key.

  • the server check the sent data with the data stored in the DB .

  • the extension acts on the status of the response .

I don't know if this is the right approach to solve this. Is there a better and more secure approach? How quick are those method to build? Are there ready-made APIs that take care of situations like this?

The software is a chrome extension built in JS and offered for free on the chrome store, so an average user can access its code. An average hacker would be able to reverse engineer it and crack it, making torrents of a cracked version and so on.

I intend to build the backend via Python and flask.

  • 1
    I suggest that you use the Chrome Web Store's payment system to do this. Read developer.chrome.com/webstore/money and developer.chrome.com/webstore/overview#charging – Robert Harvey Dec 23 '16 at 17:49
  • Also this will depend on the kind of app you're building; if it works only with access to the backend, for instance, you can protect that and not worry about the front end at all. – jonrsharpe Dec 23 '16 at 17:54
  • @RobertHarvey , sadly I can't , my country is not supported by google checkout for now, so I can't sell it on the chrome web store . – Anis Souames Dec 23 '16 at 18:10
  • @jonrsharpe What do you mean by this , could you clarify a bit more please ? – Anis Souames Dec 23 '16 at 18:11
  • 1
    Did you consider publishing your Chrome extension under a free software license? My feeling is that otherwise it is unlikely to be used & useful (unless you spend a lot of money on marketing). – Basile Starynkevitch Dec 23 '16 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.