Yeah, but do we really have to go for inspiration there?
I've given this some thought and I think there only one viable solution that's not overly complicated to implement and still rather secure.
- Each user would be given an unique encryption key used to symmetrically encrypt/decrypt skins.
- When user A uploads a skin to LFSWorld, server automatically encrypts the .jpg file with user's key.
- When user B requested user A's skin, LFS would download the encrpyted .jpg from LFS world.
- LFS would then fetch user A's key to decrypt the file, load in into memory and then it would dump the key.
- To make this method even more secure, users would be allowed to disable downloading skins for .sprs and .mprs.
Sure, this approach has a couple of shortcomings, the worst being the ability to sniff the key from network packets. It would however require for the skin thief to capture all network communication and analyze it afterwards. Another problem is reading the decrypted skins from memory directly. On the other hand, an average petty skin stealer wouldn't be up to anything like this...