Slashdot Mirror
Bringing Micropayments To the phpnuke Community
aelfakih writes "Centipaid.com made available a phpnuke add-on making it possible for anyone with a phpnuke site to collect micro fees for accessing specific sections of the site.
The module is released under GPL and it is still beta, but seems to be stable.
There is a demo of the micropayment system for phpnuke on http://phpnuke.centipaid.com. There is also a GPL Apache module that does the same thing, but it is intended for system admin with access to the apache server config files, or .htaccess.
Links to the phpnuke info is on http://www.centipaid.com/download.html as well as the phpnuke.org site.
Links to the apache::centipaid module is on http://www.centipaid.com/download.html and on freshmeat.net
"
Although techniques like these have probably been around for some time (it's not even fundamentally different than credit-card) I must say I'm truly amazed by the simplicity of this concept. It seems pretty solid. Even though the system is completely open to hackers/crackers, I can't see a way that privacy information gets anywhere but with Centipaid.
Now whether or not Centipaid is more trustworthy than Microsoft's Passport system, only time will tell. But I'm very optimistic. Great job guys!
--
Money is the root of all evil (Send $30 for more info)
A patent pending technology for electronic commerce that [uses a] "variable length key that is encrypted using blowfish algorithm then merged with the image of the stamp using another variable length password" with no peer review of the securtiy of the system? Users can "exhange stamps online and many users can use one internet stamp until it runs out of funds"? A sales site (interstamps.net) with no indication of parent company, physical address, telephone number? A completely anonomous system with a tracking serial number?
This sounds like the worst of horror stories that can be devices by Open Source and Privacy advocates combined, but we're singing its praises because it released some code under the GPL?
So apart from the many pointers that indicate that no self respecting online purchaser should hand over ANY details to this site, what about security and anonomity?
Sites you purchase from clearly can't track your identity across transactions (assuming you use a different stamp). Or can they?
Well, Centipaid or Internetstamps can certainly track all purchases you make, by virtue of the stamp's serial number. While they promise nicely in their Privacy Notice not to "materially change" their privacy policy, they reserve the right to. They also say they won't divulge "account contact or payment information", but that's easy to sidestep in a number of ways (is what your purchased and where you bought it "payment information"?).
Since Centipaid has close ties with the sellers (producer and consumers of the technology, right?), can we be sure that our purchasing trends aren't being syndicated to ALL of the sellers? Or maybe to Doubleclick or a similar organisation. All you're really doing in this system is trusting a third party to behave responsibly ... one that doesn't even provide a physical address or indication of incorporation on their website. Ouch.
As for security, well, they're rather scant on details. A quick look over the PHP source code available from the site seems to indicate that you get redirected to a gateway under Centipaid's control - a standard mechanism for payments through Trusted Third Parties. But it would also seem (although I could be mistaken) that the communication between the merchant and Centipaid is not encrypted or authenticated (signed).
Without going into detail, any third party payment system that does not use a PKI and does not have secure communication between pair of parties can be attacked. In this case it is most likely that the merchant could be attacked. Nice for the purchaser, not so nice for the seller.
Besides this is the original claim that users can "exhange stamps online and many users can use one internet stamp until it runs out of funds". So this is really a debit facility (prepaid account) with a gimmick (a pretty picture ... oooh, aaah!). Your stamp is no more or less secure than a credit card -- you just have a better ability to limit your losses.
No, I wouldn't trust the security of this system...
It may be interesting to take a read over this Internet draft, written by the guy who appears to own/run Centipaid. The paragraph entitled "Electronic postage support" is especially interesting, as is this notice: "Adonis El Fakih has a patent pending that may relate to AMDP internet draft specifically to the work derived from draft-amdp-00.txt", after which some reference is made to non-discriminatory terms.
I'll let you draw your own conclusions...
i-name =twylite [http://public.xdi.org/=twylite], see idcommons.net
The bottom of the Centipaid.com home page says, "2002 c Copyright Centipaid.com, Adonis El Fakih." Is this person "Adonis the faker"? Is this an elaborate joke?
The Centipaid.com Contact Us page does not list a telephone number, only an address, email addresses, and fax numbers. Would you trust your business to someone who won't give you a telephone number?
Centipaid.com depends entirely on another company, InternetStamps.net.
The InternetStamps.net web site doesn't seem finished. At present, the Shipping & Returns page says, "Put here your Shipping & Returns information."
The bottom of the InternetStamps.net page says, "1580 requests since Wednesday 27 November, 2002". These people are not good at marketing. If they were, they would explain their service better.
The bottom of the InternetStamps.net page also says, "Copyright c 2002 osCommerce Powered by osCommerce". What is osCommerce? Yes, I can guess, but I would like to be told definitively.
Whoever Adonis El Fakih is, English does not seem to be his first language. The Services page says, "For example you can decide to charge 1 cent to grant access for one day to one section of your site, and , while another area will be 10 cents for a week."
What is "and
Why the very long page load times?
Would this make it possible to build a system that would charge people every time they send you an email?
Instead of giving people an email address, give them a URL where they can enter their message, and this URL charges a (tiny) given amount, that will not break the bank of individuals that send you a few occasional emails. You could also have a separate URL/address to give to merchants you don't trust, that charges a lot more.
Even if spammers find out your trusted address, they can't do repeated broadcast mailings without paying a significant amount. Plus, if the sponsoring website credits your account with a % of the proceeds, in some cases merchants might offset the cost of internet usage enough so that it might end up free.
I still think the free market will eventually solve the spam problem without lots of regulation and enforcement.
Internet users already pay for content and access to web sites. It's called paying Internet access fees to your ISP. Additional fees will never be accepted. This idea is DOA.
I wonder ... could the Lebanese Postal Authority be persuaded to (act as) issuer of these stamps? That could mean that anyone trying to crack the encryption would be violating counterfeiting laws, perhaps bringing in Interpol. With all the factionalism in Lebanon, I imagine that the career beaureaucrats are the among the most discreet on the planet.
Adonis,
Everything I said still stands. Ignore those pretending to be superior by sympathizing. Do you see that I am helping you by showing you the reaction you will get from visitors?
Your sites are sloppy. Everyone makes mistakes of this sort. However, you didn't hire an editor to find them.
Marketing is trying to create a connection between your companies and the outside world. You aren't doing that successfully.
You said, "when you pick on little things like this it hurts". That is an unprofessional reaction. Do you want to be successful or do you want to have realistic criticism?
By being sloppy, you are destroying your own chances.
Everyone wants some scheme like this to succeed. We need micropayments. You seem technically competent, but ignorant about how to become an important public figure, as you will be if your companies succeed.
See my comment #5216889 below.
Mr. El Fakih's sloppiness is self-destructive. My comment has nothing to do with whether he is a nice guy. His success will depend on whether he is excellent at communicating his message.
Guess this tool can be integrated into any of the "nuke" variations, I mean centipaid.com is promoting PHPNuke.org because that is the most popular variation...but they are using PHPWebsite's variation to "demo" the use of the system. It will be interesting to see if Postnuke etc will be able to use the system because in theory this is exactly what is needed...but I do have my concerns with privacy issues etc.
However, please don't promote the use of phpNuke because the security in that software is horrendous! Just because it is popular doesn't mean it is secure....