[DrP]

Hi,

I have some MP3s hosted on my site which are accessed through some embedded SWFs. I want to protect the MP3s from being downloaded, so used a .htaccess file to prevent access, like so:

redirect 301 /music/ http://nameofsite.com/notfound.php
ErrorDocument 404 /notfound.php

However, this also stops my SWF files from accessing them. How do I get around that?

Thanks,

[cwwozniak]

The best that you might be able to do is make it difficult for someone to download and save the mp3 files. Trying to stop someone intent on downloading the file may be impossible.

Making the folder non index-able and using cryptic and not easy to guess file names may help. The player may still be caching the whole file on the visitor's hard drive and they may still be able to get a copy from the cache folder. There are ways to force the browser to ignore any no-cache commands on a web page and still cache the file.

Can you adapt your player to play a series of MP3 files without interruption? If so, breaking up your MP3 file into many smaller MP3 files may make getting a clean copy of the file much more difficult for someone.

[DrP]

I see. The obscure directory name won't work because to save me work in the future, the filenames are passed to the SWF using params in the HTML, so simply viewing the source will reveal the location. The playing them without interruption is a no-go too. Oh well, I'll just lower the quality and hope most visitors want to pay for the high-quality versions.

Is there no way I can allow SWF files to access the files without stopping people downloading the file directly?

[cwwozniak]

I am not all familiar with coding a SWF file and do not know if this is possible but could you do something like having each MP3 file name consist of two parts like plaintextname-secretcode.mp3? The "secretcode" part would be coded inside the SWF file and not change. You would then just need to pass the "plaintextname" part in your HTML code and the SWF code would add the secret part to get the correct file. This would not stop someone from digging the file out of their browser cache.

Don't forget that no matter how much you do to hide or encrypt the file and prevent someone from downloading it, the person still has to be able to hear it. That means that they can capture the digital data feeding the sound controller or digitally record the analog signal coming out of the controller.

[DrP]

Okay. Thanks for the advice. I'll have to hard-code the directory the music files are in into the SWF and only pass the filename as a param in the HTML. I know I can't stop people accessing it through the cache, so I'll just have to live with that.

Thanks again,

[cwwozniak]

You're welcome.

[briealeida]

You could try hosting the MP3s in your home directory and having the SWFs access them by the full path name.

[JimmySeal]

Even if you obfuscate the paths and file names, it'll probably be easy enough for someone to use Fiddler or something else to watch the web requests and figure out the path and filename, though I'm not sure how many people would be likely to do this.

If you could store the files in an encrypted format on your server and have the SWF decrypt them before playing them but I don't know how easily that can be done with SWF.

Your best bet may be to use low-fi versions of your songs, or shortened versions, or both.