Password traders & Proxies

[Jicky Jack]

Hello all, I noticed a new user has placed a bot on my site and downloaded all 2 gigis of my exclusive images. -ok he paid for that so I'm fine with it. But on 3 more days the same UN/PW download all 2 gigs of the same content again!!???? I checked the IP and it is the same IP from Czec Republic on all occasions...

My Question to the techies: Are pasword traders now using a proxie or something to share passwords to avoid mulitple IP blocks?? Is that possible??? or is this guy just a fool that dosent know how to turn his bot off or find the saved folder location?

a side note: on all occasions it seems the DL speed was quite different...
|angry|

J

[neticule]

Yes, that is very common with the 'smart' password traders, you have to use a proxy to get in so it appears its the same user.

:(

[Cleo]

Strongbox will put an end to this.

[Head Boy]

Would honest members be resistant to a password change every time they log in?

[Jicky Jack]

Strongbox will put an end to this.
Or maybe get a mod for this and redirect that IP... http://www.homestarrunner.com/systemisdown.html I need strongbox to kick some ass! |angry|

[Rocco]

wow, these password traders got always better tricks

[chilihost]

yup its true, a lot of them are setting up special proggies too that login to your site via a set proxy and download away...one thing you can check is your raw log files to see if they are all using the same browser and identifiying themselves as the same computer (ie, their operating system, versions, etc). At least that will give you an answer to your question. Then run to Ray to get strongbox installed ; :D

cheers,
Luke

[SinSational]

Strongbox will put an end to this.

i second that. we just had strongbox installed for a client a few weeks ago and it has been amazing.

[Bruce Miller]

Where can I find out more info on Strong Box?

[SinSational]

http://www.bettercgi.com/strongbox

[lasho]

strongbox makes members pissed...It causes damn many problems for every user. I bought a membership from a site uses strongbox and see what happens...

-OCR image was wrong
-I had to re-login everytime open a picture in new window( dont tell me cookie shit lamers I knew what to do)
-When I try downloading a movie which is i.e 100mb. Downdload process stops at 20-30 mb
-my password is blocked because my isp changes my ip every 24 hours...

Damn strongbox i hate ya

[SirMoby]

Would honest members be resistant to a password change every time they log in?
WOuld you like to change one of your passwords every 24 hours? I thnk members would hate it.

I haven't had any complaints from members since I installed Strongbox. Iw as getting complaints when I used PennyWize

[nekrom]

Yupers, most crackers nowdays post what proxie goes with what combo, to a cracked site. Also most common proxies used to access members areas, are from those free anon surfing site thingos.

-N

[Hellpuppy]

Strongbox will do the job, but it's a sledgehammer solution and is NOT seamless to the users.

I also like Pennywize, have used it for years on most of our paysites with great success. It also lets you limit the number of bytes that a user can get per day. This can contain the spiders.

[funsmut]

Hi Jicky Jack,

Check these solutions below for securing Apache server against brute-force password cracking attacks and password-sharing:

http://www.proxypass.com/ <= I recommend this one
http://www.pennywize.com/

good luck

[SirMoby]

Strongbox will do the job, but it's a sledgehammer solution and is NOT seamless to the users.

That's an interesting statement. It's true that a standard form now collects the username a password instead of the web browsers authentication popup but that's it. It acutally looks more integrated into my site.

When I was running Pennywizw I got complaint emails almost daily. Now I think I've had 1 surfer have issues in over 6 months.

I have heard good things about ProxyPass.

[romeoboi]

does strongbox stop those programs that download the whole members area or is it just stop password trading?

i dont run a paysite, just curious

[Hellpuppy]

That's an interesting statement. It's true that a standard form now collects the username a password instead of the web browsers authentication popup but that's it. It acutally looks more integrated into my site.

When I was running Pennywizw I got complaint emails almost daily. Now I think I've had 1 surfer have issues in over 6 months.

I have heard good things about ProxyPass.

I've ran pennywize since 1998 or so even back when it was a CGI you ran locally. And this has included some very busy sites, and the only complaints I've heard are from people who are trying to cheat. Since it works by scanning the logs and doesn't redirect the user until thresholds are exceeded, this is as I would expect.

I'll admit that I tend to stick with things that work until such time as they cease to work for me. So, I may have a bit of bias just due to longevity. Heck, I still use mkstats. ;)

However, there are tons of good solutions out there to choose from, strongbox certainly among them. Your mileage may vary.