Closed nascentt closed 7 months ago
Hey, no probs ;) Just keep the bugs coming :)
The reason for using Google Play handling the payments is but a pragmatic one. Having Google handling payments, customer's credit cards, possible reimbursements and all payment-related things is comfortable since I don't have to do those things by myself, securing the payment server, thinking of a schema with license keys, their revocation, offline/online sync etc. Even though Google charges 30% and the countries charge 20% VAT, it's still worth it since I can focus my limited time on fixing bugs and adding features to PhotoCloud.
With that being said, I understand it is very cumbersome for users of devices without Google Play. Let me think of a solution. Please feel free to write me to vysny@baka.sk regarding the Photo Frames you build and use (I'm also interested in what kind of Android devices have no Google Play built-in). I guess it's not easy to install Google Play afterwards since it's proprietary and there are lots of protection against hacking/piracy/etc.
I emailed you but for completeness I'll summarise here: xiaomi devices and amazon kindle fire devices which need apps to be sideloaded
On 28 December 2017 at 18:07, Martin Vysny notifications@github.com wrote:
Hey, no probs ;) Just keep the bugs coming :)
The reason for using Google Play handling the payments is but a pragmatic one. Having Google handling payments, customer's credit cards, possible reimbursements and all payment-related things is comfortable since I don't have to do those things by myself, securing the payment server, thinking of a schema with license keys, their revocation, offline/online sync etc. Even though Google charges 30% and the countries charge 20% VAT, it's still worth it since I can focus my limited time on fixing bugs and adding features to PhotoCloud.
With that being said, I understand it is very cumbersome for users of devices without Google Play. Let me think of a solution. Please feel free to write me to vysny@baka.sk regarding the Photo Frames you build and use (I'm also interested in what kind of Android devices have no Google Play built-in). I guess it's not easy to install Google Play afterwards since it's proprietary and there are lots of protection against hacking/piracy/etc.
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mvysny/photocloud-frame-slideshow/issues/61#issuecomment-354329921, or mute the thread https://github.com/notifications/unsubscribe-auth/ABF7enHyecRLlqFszTB7NdiBJjJ4CHuJks5tE9jTgaJpZM4ROTjw .
Amazon Kindle fire devices - do they have Amazon's built-in app store? There is Amazon Underground version of photocloud, could you please try out that one? Also see #48 regarding this. Perhaps it would be enough if I added support for purchases from Amazon's app store?
I thought about having a key server and maintaining the set of license codes. That's actually doable, and could be done quite quickly. The problem with this kind of approach is as follows:
I however understand that it may not be possible to install Google Play and/or Amazon App Store onto the devices; since they are intended as a gift you shouldn't use your credentials for such devices.
However, there is a solution. There are lots of third-party App Stores, offering their own versions of "App Store" apps, which could be sideloaded way more easily onto the devices which lack both Google Play and Amazon App Store. You can for example try http://www.aptoide.com/ - download their App Store app here: https://aptoide.en.aptoide.com/ , try to sideload it onto your device and let me know if that worked. If that works, I can then port PhotoCloud to Aptoide in-app-purchases API, you can log in into Aptoide on those devices, make the purchase and install PhotoCloud on those devices.
The auto-update issue is true, but that's the nature of using devices without google play in the first place. One of my gifts is going to a house that doesn't have internet anyway, so the version of photocloud out when I gift that one will remain as is forever. One I've given and I doubt I'll ever see it again, so that will remain as is, the other I'll probably visit every few months so can manually update.
I'm unfamiliar with Aptoide, I've installed it on my Xiaomi device, but from what it sounds like - I'd still need to login to that and then give this company my credit card info to pay for a license? So not only am I leaving my account on the gift devices but I'm also giving my credit card to a random company?
Maybe I'm misunderstanding?
On 31 December 2017 at 17:51, Martin Vysny notifications@github.com wrote:
I thought about having a key server and maintaining the set of license codes. That's actually doable, and could be done quite quickly. The problem with this kind of approach is as follows:
- You have to obtain the APK first. Since you are using APKs not from me directly, but from unofficial APK download sites, I can not guarantee the content of such APKs. Such sites typically repackage the apps and include trojans and/or viruses. To avoid this, you should use only the official channels: Google Play and Amazon Underground.
- When installing APKs manually, you will never receive updates and bug fixes to PhotoCloud.
I however understand that it may not be possible to install Google Play and/or Amazon App Store onto the devices; since they are intended as a gift you shouldn't use your credentials for such devices.
However, there is a solution. There are lots of third-party App Stores, offering their own versions of "App Store" apps, which could be sideloaded way more easily onto the devices such as xiaomi (although I just bought xiaomi phone and it has Google Play preinstalled). You can for example try http://www.aptoide.com/ - download their App Store app here: https://aptoide.en.aptoide.com/ , try to sideload it onto your device and let me know if that worked. If that works, I can then port PhotoCloud to Aptoide in-app-purchases API, you can log in into Aptoide on those devices, make the purchase and install PhotoCloud on those devices.
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mvysny/photocloud-frame-slideshow/issues/61#issuecomment-354616554, or mute the thread https://github.com/notifications/unsubscribe-auth/ABF7eth0m6oxTAsUmmesped0YzfUSnEQks5tF8mwgaJpZM4ROTjw .
Yeah, you're right, that is correct - you need to make a purchase at Aptoide; maybe there are gift cards purchasable at kiosks in your country like Google Play, but I doubt it. And I would have to add support for Aptoide anyway.
However, the income from the app is low; the amount of work to implement own way of unlock system is moderate and the risk of piracy is high.
I have thought of the following solution:
The problem here is that this solution can be pirated easily. Because of the piracy and the amount of work required to implement this, I'm not yet convinced that this is a good solution. Also, integrating with a pre-existing App Store can be done sooner than rolling out a customized solution.
Please let me know your thoughts on this.
That sounds like a perfectly fair and sensible comprise. Can you confirm that one purchasing the use once key that there's no immediate expiry if they're not used right away? It'll probably be a few months until I have access to the gifted tablets again .
On 2 Jan 2018 9:32 a.m., "Martin Vysny" notifications@github.com wrote:
Yeah, you're right, that is correct - you need to make a purchase at Aptoide; maybe there are gift cards purchasable at kiosks in your country like Google Play, but I doubt it. And I would have to add support for Aptoide anyway.
However, the income from the app is low; the amount of work to implement own way of payment system is moderate and the risk of piracy is high.
I have thought of the following solution:
- I will implement a very simple system of one-off codes. You will install the PhotoCloud APK onto your device; then there will be a possibility to enter an activation code which would unlock all PhotoCloud features. This activation process will require online access; after the app is unlocked, no further internet access is required. The app will remain unlocked indefinitely while installed.
- The code will be one time only. You will not be able to use the code to unlock another app, nor you will be able to unlock the app again if you reinstall it on a device.
- You already know how to obtain PhotoCloud APK files; however for increased safety I can publish the official APKs somewhere.
- The price is currently 7 EUR per one code; just send me 7 EUR times the number of codes you would like to purchase to my vysny@baka.sk PayPal account and make sure to include your email - I will then mail you the codes back.
- This method of payment is not meant to replace the Google Play purchases; this is just a workaround for gift devices.
The problem here is that this solution can be pirated extremely easily. I'm not yet convinced that this is a good solution. Also, integrating with a pre-existing App Store can be done far quicker than rolling out a customized solution.
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mvysny/photocloud-frame-slideshow/issues/61#issuecomment-354728705, or mute the thread https://github.com/notifications/unsubscribe-auth/ABF7eoqLWTEZoePz35AqxxCOdqSEoWf7ks5tGfetgaJpZM4ROTjw .
Sure, there will be no expiration date (unless I suddenly die :-D ) . You can activate the app with the code at any time (but only once), and the app will remain activated unless uninstalled (or the device is factory-reset). Also the key should survive APK upgrades, but I'll test this in an Emulator (it has no Google Play so it's a perfect testing ground).
Sounds all great! Let me know when you're ready for all this and I'll send through 3 payments right away!
"app will remain activated unless uninstalled (or the device is factory-reset)" That actually raises an interesting question. What if the device needs a reset? I've owned samsung devices in the past that had such a messy touchwiz interface, they they needed pretty frequent factory resets. Of course in those cases I had google play, but it does raise an interesting hypothetical situation. Any way to tie the keys to the device IMEI or hardware serial number or something? at least in terms of your end so that you could theoretically generate a new key for someone that had to reset their device.
Hopefully - at least in my case - as these are passive devices that wont be interacted with by the users, they should last years without needing any type of factory reset (but I guess an over the air upgrade by amazon might screw things up).
As an aside If you're at all curious about how I've setup my photoframes I'd be happy to give you details if you wanted to advertise such functionality when you've setup a license key system.
On 2 January 2018 at 10:43, Martin Vysny notifications@github.com wrote:
Sure, there will be no expiration date (unless I suddenly die :-D ) . You can activate the app with the code at any time (but only once), and the app will remain activated unless uninstalled (or the device is factory-reset). Also the key should survive APK upgrades, but I'll test this in an Emulator (it has no Google Play so it's a perfect testing ground).
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mvysny/photocloud-frame-slideshow/issues/61#issuecomment-354740198, or mute the thread https://github.com/notifications/unsubscribe-auth/ABF7esrRgYgxs0ObixRjbMsFL9m7UetJks5tGghRgaJpZM4ROTjw .
Unfortunately this is not easy. The IMEI only relates to phones; it is null for tablets. Please see https://developer.android.com/training/articles/user-data-ids.html : they suggest to use Android ID but that is auto-generated when the device is factory-reset. Also can be changed on rooted phones, so it's not a 100% protection against piracy. IMEI is null for tablets. I can't use 3 private GUID since I'm trying to prevent payment fraud. TelephonyManager.getDeviceId()
is null for tablets.
As you can see, it is very hard to actually protect against piracy. Probably the best way is to use Android ID, but it's reset on factory reset, and doesn't offer 100% protection against piracy since it can be changed on rooted devices. There is android.os.Build.SERIAL - that may be useful but is null for phones. A combination of SERIAL and device_id could be used, but reading deviceId requires the READ_PHONE_STATE privilege which may be suspicious to the users.
As you can see, coming up with a custom payment system which is not susceptible to piracy (or the risk of piracy is tolerable) is not easy :(
Eek. Sorry, didn't realise how difficult it was to identify a device. I would've thought mac address would've been a good option but they prevent/discourage it. I really didn't meant to give you so much work to do. I guess just go with Android ID. Photoframes are pretty passive devices anyway, so the need to change and reset them seems very low to me. I was just more concerned about an ota corrupting things especially with locked down devices like Kindle Fire Tablets. But it's really not worth stressing so much. I'll take what I can get.
On 9 January 2018 at 10:30, Martin Vysny notifications@github.com wrote:
Unfortunately this is not easy. The IMEI only relates to phones; it is null for tablets. Please see https://developer.android.com/ training/articles/user-data-ids.html : they suggest to use Android ID but that is auto-generated when the device is factory-reset. Also can be changed on rooted phones, so it's not a 100% protection against piracy. IMEI is null for tablets. I can't use 3 private GUID since I'm trying to prevent payment fraud. TelephonyManager.getDeviceId() is null for tablets.
As you can see, it is very hard to actually protect against piracy. Probably the best way is to use Android ID, but it's reset on factory reset, and doesn't offer 100% protection against piracy since it can be changed on rooted devices. There is android.os.Build.SERIAL - that may be useful but is null for phones. A combination of SERIAL and device_id could be used, but reading deviceId requires the READ_PHONE_STATE privilege which may be suspicious to the users.
As you can see, coming up with a custom payment system which is not susceptible to piracy (or the risk of piracy is tolerable) is not easy :(
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mvysny/photocloud-frame-slideshow/issues/61#issuecomment-356244569, or mute the thread https://github.com/notifications/unsubscribe-auth/ABF7egsCuYOjYa9Y2gHBwxOFq6hVfOmOks5tIz-0gaJpZM4ROTjw .
Sorry about that, it is harder than I expected. I also thought I should use MAC address, however on Android one can only obtain MAC address when the Wifi is turned on; turning it off would cause PhotoCloud to obtain zero mac address and fail the key verification :/ Also MAC address can be changed rather easily on rooted devices. The worst thing is that it seems that there is no perfect solution. I also think that using Android ID is the way to go.
I jump on this as well. Have an odroid and would love not having google play installed only for using it as a photoframe, the same for the old tablet I am using. No usage of Google Play would allow me to use the login information on this account, which I do not like at all, just for a photoframe everyone could theoretically get hands on.
Alright, I think this can be arranged. I hope your devices are running Android 19 or latter (that's android 4.4 or higher), since newest photocloud only runs on such devices. I'll implement the system of one-off codes as discussed above. The code can only be used once, and if the app is uninstalled a new one off code needs to be purchased. The price is 7 eur, paid via PayPal. Does this sound fair?
Alright, I think this can be arranged. I hope your devices are running Android 19 or latter (that's android 4.4 or higher), since newest photocloud only runs on such devices. I'll implement the system of one-off codes as discussed above. The code can only be used once, and if the app is uninstalled a new one off code needs to be purchased. The price is 7 eur, paid via PayPal. Does this sound fair?
7 Euro sounds fair, also the one-device limitation, but reinstalling the device or even reinstall the app on the same device should not force anyone to buy a new code. Actually even if I replace the device with a new one, I would like to reuse the old code because still using only one device with the app. And I learned one thing, android tablets/devices they do not last "forever", most of them need to be exchanged of hardware failure or too old OS running for a specific app needed.
Perhaps there is another way. Photocloud needs to be online anyhow to properly work, refreshing the license token every 24 hours or 48 hours or once a week to keep the app active would be good. With this, the server can also verify if ther was another device using the same token to license the app and can refuse a new token. More or less like most authentication systems are working right now.
I am happy to pay for 3 tokens to use them on 3 devices, but not if I need to buy a new one if it gets replaced/resetup/reinstalled. Using Google Play services I can use one purchase on as many devices as I want. Therefor something in between would be nice, but the above solution is not convincing. The pricing would be ok.
Perhaps there is another way. Photocloud needs to be online anyhow to properly work, refreshing the license token every 24 hours or 48 hours or once a week to keep the app active would be good. With this, the server can also verify if ther was another device using the same token to license the app and can refuse a new token. More or less like most authentication systems are working right now.
Unfortunately @nascentt plans to have the device offline, streaming photos from a sd-card only. That would effectively disable any online license checks.
However what you say is reasonable too. Maybe the system would need to support two cases:
This sounds great, would allow everyone to be satisfied (if it is worth the effort anyhow)
1) google play purchase with an account 2) offline purchase 3) online purchase without google play installed
I am using option 1 right now for 4 devices. I would love to move 2 devices to option 3, because I cannot guarantee others playing around with the device. Getting rid of any google account thing would be great. What are the minimum requirements for option 3? I am not sure if every device is running at least 4.4 - I need to verify that next time I lay hands on them.
If the 24 hours lease is sufficient, I cannot say, I have no statistics yet for how long the devices do go offline (because not needed, holidays etc) and if and for how long the internet connection to that devices may drop, but lets start somewhere :)
Well, there is quite a lot of effort to be done, and it's really hard to see whether it will be worth it. Implementing option 3. is quite hard to test, therefore for starters I'm thinking of implementing option number 2. Even that would require a lot of effort, for example I need to implement the license server. Maybe there are solutions around? Let me search.
Recent versions of PhotoCloud requires Android 4.4, regardless of whether it was obtained with option number 1, 2 or 3.
Uh-oh, Google legal bans this possibility of using another pay system:
App purchases: Developers charging for apps and downloads from Google Play must do so by using Google Play's payment system. In-app purchases: Developers offering virtual goods or currencies within a game downloaded from Google Play must use Google Play's in-app billing service as the method of payment. Developers offering additional content, services or functionality within another category of app downloaded from Google Play must use Google Play's in-app billing service as the method of payment, except: where payment is primarily for physical goods or services (e.g., buying movie tickets, or buying a publication where the price also includes a hard copy subscription); or where payment is for digital content or goods that may be consumed outside of the app itself (e.g., buying songs that can be played on other music players).
Well, I guess I could publish one version of PhotoCloud to Google Play which would only use Google Play billing system (Google is really eager to protect their 30% rip-off off every payment); having another version outside of Google Play which would only allow external payments... This is getting complicated :(
Hmm, I think that is the reason why some developers offer a standard version and a "unlocker" app which can be purchased directly from google play store or downloaded as a apk from their site incl. another option to unlock. But ok, it needs to pay off for you, at the end.
It all depends on how secure I want this to be. A general unlocker app is very easy to crack+pirate, simply create an APK back from the installed app and side-load it to all devices.
However, this is a very interesting possibility for me as well since this could simplify things quite a bit. I'll think about this possibility also.
Installing PhotoCloud without Google Play will require you to copy both the PhotoCloud APK (and possibly the unlocker app) to the SD Card and install it from there; you then need to enable the possibility to install apps from unverified sources in your device settings. Would you be okay with such a procedure?
Just wanted to comment that I'd be totally okay with such a procedure. Honestly, any procedure that doesn't require additional apps to be installed, for performance and capacity reasons. Any form that requires a one-time online login is good too - you can easily verify license usage based on external IP addresses. Based on a DNS lookup of myip.opendns.org through resolver1.opendns.com, or other techniques such as STUN (and many, many others), you can monitor activations based on the external IP. If the external IP changes (DNS resolution succeeds and has a different output), re-login or post an image that says that online connectivity needs to be restored to renew the activation. Maybe this can be tied-in with the unlocker app's properties. Maybe tie-in other factors in the signature, such as date and time based on your server.
For custom, large scale deployments, you should have a business-related sales page for pricing. You will be able to monitor extremely large bulks of activations from a single location, and contact the owner based on the account. It is highly unlikely that a VPN would be used to scam this data, but that's the only piracy option (and even that, when everything is implemented correctly, will likely surface too).
This opens up PhotoCloud to all AOSP builds for quite a huge number of legacy devices, which would be a great fit for a slideshow. I'd really appreciate a PayPal link to get the unlocker or any other alternative.
Thank you, that sounds good. Yet I believe it's best to start with a simple solution at first, then make it more secure as this way becomes more widely used.
Proposal: instead of DNS/STUN/other techniques I will send you a set of one-off codes; the code will activate the app on one device and will then stop working; so if you uninstall photocloud or factory-reset the device you will need another one-off code. To balance this disadvantage the codes will be cheaper (e.g. one code would cost 1 EUR). During the activation the app will need to be online, then the app doesn't need to be online anymore. The code will look like this: e03d4174-820e-11ea-898b-23a37ee3526a
.
How does this sound? Would this work for you?
Yes, that definitely works for me. Thanks for the prompt response.
Sounds good! My e-mail (and also PayPal account) is martin@vysny.me - please drop me an email so that we can discuss this outside of public channels. Thanks!
Hi Martin, I just want to check on this request.
I originally reported this 3 years ago beause I was setting up some amazon fire tablets as gifts to family members as well as myself and wanted to use your amazing app and get rid of the nagware screen.
I also bought the IAP on google store to help fund.
I obviously gave those gifts at christmas 2017 so ended up having to use another app instead. However three years have passed and there's been multiple times I've revisted this and have seen other people log their own requests for this. I now have a huawei device that I wanted to use for myself as a photoframe which desn't have google play services . The last I see about this is DDRRE being offered to buy a code however I don't see this option mentioned anywhere, so even available within the app.
How would I (or anyone) unlock photocloud slideshow in 2020/21 without google play services? More than happy to pay for an unlock code. Should I meail you directly?
Hi, I'm sorry for no activity on this. I have been designing an one-off code server (which is the easy part), then I've hit a couple of problems: if the code is not tied to the Android ID then it's easy to pirate the app; if the code is tied to the Android ID then it's tedious to mass-install on devices. On top of that, Google wants everybody to use Google Play and threatens to close my account if I do otherwise, which is something I can't afford to let happen. Moreover I'm quite close to burning out which is something I definitely can't afford to happen.
I can't promise anything but I'll try to create a quick-and-dirty prototype though - maybe it could be finalized rather quickly.
Definitely don't want you to burn out, and don't want your account closed. It's unfortunate that the typical device people will want to turn into a photoframe is a device that can't really be used for anything else. So aside from very old versions of android, you've got people using cheap half-android devices like amazon, xiaomi, huawei which dont easily support paid versions of apps.
I feel like google should be spending more time trying to make things easier for developers and customers than wasting time trying to kill off developers and customers as punishment. When I used to search for photoframe apps on the paly store 4 years ago there was basically nothing, so when you made a really decent one that does anythin anyone could possibly want without bloat I was thrilled, but the state of the google play stoe now is a shock, if you search for photofram apps now you just get hundreds of fake review filled chinese junk that barely managed to act as a photo frame at all, and even more so when you want SMB/cloud support.
Your app should be more successful than all of the chinese crap combined and google should have made you a featured app a while ago.
I appreciate any time you've put into this app, and any you will put into this app. You don't owe me or anynone anything so would understand (but be obivously sad) if you decided to not proceed with requests like this. You deserve lots of success for this great app and your great support.
Thank you so much for being so understanding, it's very nice of you. Yeah, it's not fair, but there's definitely something we can do about it :muscle:
A bit of good news - I have an idea on how to implement this in a very simple way. It will be based on Android ID (so don't factory-reset your device :-D ) and other tablet info; the verification will be offline, no server needed, which will simplify the entire thing a lot. You'll just e-mail me a number which the app will tell you; I'll then send you an unlock key in response which you will simply type into the app. You can save the unlock key and it will work repeatedly even if the app is reinstalled; no time limitation. The unlock key will however stop working upon device factory reset.
Just give me a bit of time to implement this :+1: Could you contact me at martin@vysny.me so that we can run a private testing round? That way I will be able to send you more keys for free if the verification algorithm stops working for some reason.
Offline verifaction based on android id definitely sounds like the most logical method. Also covers the inevitable scenarios where the tablet wont have internet access. I'll shoot you an email now.
Hi, Martin. I followed several of your earlier discussions and got here finally.
First of all, a big thumb up for the digital photo app that you work on. I've been using it for months with an abandoned Lenovo tablet until the unit died earlier 2021. That was an experimental piece and that's why I stayed on the free version until recently, I experience the similar Play service API false issue on a little project I started. I am not using the Kinder Fire tablet. I installed a Lineage OS based Android system (built by KonstaKANG) on to a Raspberry Pi 4B. I have Google Play services installed and had the Raspberry Pi verified / certified by Google Play. I actually installed PhotoCloud on the Raspberry Pi via Play Store. I am not sure what went wrong and caused the API issue. I wonder if the version with offline verification method is now ready for the public.
Hi! Hmm, that error message doesn't make any sense since PhotoCloud is using the Billing library version 6.0.1, so it's definitely newer than 3. Maybe the Google Play itself is old? Also, which version of PhotoCloud do you have installed please? Also, could you open a new bug report in this regard, since it's unrelated to the original topic?
Regarding the original topic of unlocking the app via license codes: Yup it's fully supported now. Reach out to me at martin@vysny.me if you'd like to purchase a special version of PhotoCloud along with the license key.
Please find more information at https://www.android-photo-frame.eu/ "Offline Licenses"
I know I said last request all of 5 minutes ago, but this one would probably benefit you more than any of the others. The ability to pay for a license key that can be registered on the app for devices that dont come with google play services (of which I have 4 alone). They're all wifi connected devices with internet, so a separate authentication service could be possible if you're not trusting of an offline registration. It's just sad to me that there's no way to pay you for devices without google play, and also no way to remove the commercial screen requesting money - as there's no google play services (I tried adding it to a few devices but never got it to work).
It'd be nice to buy license keys from you to be added in some dialog in the about screen or something. would mean you get some money for the photoframes I built and gifted using your app, and also would make them look less 'cheap' by advertising for money between sentimental photos, despite not having the ability to pay.