0

I have a file on my website which users can download. After clicking the download button, then I show a div with user agreements and two buttons, "accept user agreement" and "decline user agreement".

If the user presses "accept user agreement" then I append the GET Parameter &useragreement=1 to the download URL, otherwise &useragreement=0.

Then on the server side i check if useragreement == 1 and if true, initiate the download, otherwise initiate a page reload.

However, a user could just manipulate the url and add &useragreement=1 to download a file without even reading the user agreements.

Questions

A: Is it considered as cyber crime (hacking) to bypass the user agreement window like this?

B: How can I improve it?

Improve this question
3
  • Is them bypassing in this way different to them opening the popup, and immediately clicking "Accept"? From watching people dealing with these popups, that probably accounts for 90%+ of users... As long as you're storing who triggered the agreement, you've probably got a good argument to say that they've accepted the agreement, whether they read it or not.
    – Matthew
    Dec 15, 2016 at 10:30
  • I made sure that they at least can't immediately press on the accept button, by only activating the button when the users scrolled to the bottom of the user agreements.
    – Black
    Dec 15, 2016 at 10:33
  • 1
    User agreements accepted with a click are a quite controversial legal subject in general. Courts all around the world are quite aware that nobody reads those agreements. There were some court decisions here and there which struck down certain user agreements for requiring consent to things far too serious to handle with just a click. But such decisions are always only relevant for a specific jurisdiction and only apply to specific circumstances. Ask on law stackexchange for more information.
    – Philipp
    Dec 15, 2016 at 10:52

2 Answers 2

Reset to default
3

Whether or not this is a cyber crime depends on the jurisdiction you and them are in, and even then it is a topic for law stackexchange. So I am not going to talk about that.

If you want to make sure that only users which at least saw the user agreement can download a file, you need to give them (or rather their web browser) a secret together with the license agreement.

Don't have the user agreement page set a simple 0/1 token.

  • When you generate the user agreement page on the server, randomly generate an unique token for each page impression. Put that token both into a hidden input field on the agreement-page and store it in your database.
  • Have the submit-button below the agreement also submit that token
  • Have the download-page check if that token is in the database. If it is, allow the download and delete the token from the database so it can not be used again.
  • (optional) regularly purge tokens from your database which weren't used within X hours to prevent your database form getting too large and slow due to unused tokens accumulating in it.

By the way, this is also a good precaution against bandwidth stealing, because deep-links directly on your downloads won't work. Anyone linking to files on your website will have to link at least to the agreement page.

Improve this answer
2
  • 2
    Nice solution. But it would still be possible for somebody to access the site, grab the link with the one-time token and send it to somebody else so that the other one does not need to see the agreement. This might be improved by not using random token but a protected (i.e. HMAC) token made of the clients IP address, a short expiration time and maybe some browser information. This way one can also remove the dependency on a database.
    – Steffen Ullrich
    Dec 15, 2016 at 10:56
  • At the end I solved it by using PHP sessions, it is still possible to trick the server by manually sending GET params, but at least direct download links are not possible anymore. Another possible solution would be to additionaly add a disclaimer which says that pressing on a download button implies accepting the user agreements. Thats how NVIDIA is handling it. More infos about law: law.stackexchange.com/questions/15917/…
    – Black
    Dec 21, 2016 at 12:56
2

A: Is it considered as cyber crime (hacking) to bypass the user agreement window like this?

That's a legal question and off-topic. Try law.stackexchange.com instead. But I very much doubt that this is considered a cyber crime in most countries.

B: How can I improve it?

Make sure that the request containing useragreement=1 is issued by the same site and that the referring URL had useragreement=0. You might check the HTTP Referer header for this. This way one could at least argue that the user knowingly bypassed the agreement (i.e. instead of just follow a link somebody else published) and depending on the local law this can be interpreted as if the user is in this case still bound the agreement anyway. But again, legal discussions or off-topic here but you might ask at law.stackexchange.com if this technical block is enough.

Improve this answer
2
  • 1
    Referer's are optional, though. You need to consider how to deal with users who switched off referer's in their browser settings.
    – Philipp
    Dec 15, 2016 at 10:46
  • @Philipp: I like your idea with the random token more anyway. I only left my answer to show that there could be another way too.
    – Steffen Ullrich
    Dec 15, 2016 at 10:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .