Scammer Alert - Affiliates Read This - GoFuckYourself.com - Adult Webmaster Forum

X

iBanker

Confirmed User

Join Date: Dec 2004

Posts: 2758
Share

Post
#1

Scammer Alert - Affiliates Read This

07-29-2005, 01:19 PM

Just had this conversation...

EDITED (02:00 PM) : hello, i'm working for EDITED, my login "EDITED" dosen't work.

Chris (02:00 PM) : Let me check it for you then. One sec.

EDITED (02:00 PM) : thanks

Chris (02:00 PM) : What is your affiliate ID number?

EDITED (02:01 PM) : i have to ask my boss, i'll contact you later

Chris (02:01 PM) : okay, I will be here

(THIS IS WHERE I START WONDERING WTF?)

Chris (02:02 PM) : Do you have any other info I could look you up with? Last name? Email address on the account?

EDITED (02:02 PM) : EDITED EDITED (first last)

EDITED (02:03 PM) : [email protected]

Chris (02:04 PM) : And what is the problem? You can't log in?

EDITED (02:04 PM) : i can't login

Chris (02:04 PM) : What username and password are you using?

EDITED (02:05 PM) : username is EDITED

EDITED (02:05 PM) : i don't have the password here.

EDITED (02:06 PM) : can i contact you by email later? for you give me info

Chris (02:07 PM) : Well, sorry to be the one to tell you this. But some of the information you gave me does not match up. And you have to give me the proper password for me to reset it at this point. So one of two things is happening here: ONE - YOU are a scammer and I am telling you to FUCK OFF and stay away from my affiliates. Or TWO - this is just a miscommunication and I will need to contact your ?boss?.

Chris (02:07 PM) : If it is TWO, then you understand why I keep the information so private.

Chris (02:08 PM) : Any response to that sir?

It has been 10 minutes and no reply. This is the second one like this I have got in the last 3 days. Someone is out there with a list of affiliate names I think trying to get access to other peoples accounts to most likely change their payment information. A particular account like this gets paid out some very good money EVERY week.

Heads up guys, thats all.

www.JasonandAlex.com
Christopher's ICQ: 268-843-170
Tags: None
pawsregd

Confirmed User

Join Date: Jun 2005

Posts: 2290
Share

Post
#2

07-29-2005, 01:21 PM

It's the FTC!!! lol
Comment
polish_aristocrat

Too lazy to set a custom title

Join Date: Jul 2002

Posts: 40377
Share

Post
#3

07-29-2005, 01:21 PM

Originally posted by pawsregd

It's the FTC!!! lol

lol 5678

I don't use ICQ anymore.
Comment
iBanker

Confirmed User

Join Date: Dec 2004

Posts: 2758
Share

Post
#4

07-29-2005, 01:25 PM

Heh, I had to edit it all out for the real affiliate...

www.JasonandAlex.com
Christopher's ICQ: 268-843-170
Comment
Doctor Dre

Too lazy to set a custom title

Join Date: Jan 2001

Posts: 51692
Share

Post
#5

07-29-2005, 01:34 PM

Yea ... makes it hard for honest affiliates that forget their passwords !

I forgot my pgonzo pass and it was a headache to receive it

Originally posted by rayadp05

I rebooted, deleted temp files, history, cookies and everything...still cannot view the news clip. All I see is that fucking gay ass music video from "Rick Roll". Anyone else have a different link to the news clip?
Comment
TMM_John

Confirmed User

Join Date: May 2004

Posts: 6665
Share

Post
#6

07-29-2005, 01:36 PM

Good catch

Too Much Media - Makers of the Industry's Leading Payite Management Platform, NATS!
Comment
iBanker

Confirmed User

Join Date: Dec 2004

Posts: 2758
Share

Post
#7

07-29-2005, 02:13 PM

We are going to have to incorporate some new password system to prevent this. It seems like the only solution worth merit. Anyone have any suggestions?

Maybe something along the lines of a secret question/secret answer? Is that stuff even worth while?

www.JasonandAlex.com
Christopher's ICQ: 268-843-170
Comment
The Other Steve

Confirmed User

Join Date: Dec 2001

Posts: 2106
Share

Post
#8

07-29-2005, 02:30 PM

Perhaps respond in person to those requests with a phone call to the number listed on the account details?

Left intentionally blank ... just like my brain
Comment
iBanker

Confirmed User

Join Date: Dec 2004

Posts: 2758
Share

Post
#9

07-29-2005, 03:30 PM

Originally posted by The Other Steve

Perhaps respond in person to those requests with a phone call to the number listed on the account details?

I put a little thought into that as well, but the fact is most affiliates don't put in their phone number. And its Funny, alot of them have the same number "123456789". They must all live at the same house. I think they think we want to telemarket stuff to them. lol

I really wish more did, it would be easily solved that way.

www.JasonandAlex.com
Christopher's ICQ: 268-843-170
Comment
Donny

As you wish...

Join Date: May 2002

Posts: 13754
Share

Post
#10

07-29-2005, 03:30 PM

Well, can't say I didn't try....
Comment
Murderous

Confirmed User

Join Date: Oct 2003

Posts: 3938
Share

Post
#11

07-29-2005, 03:30 PM

AND provide them with a phone number to call you.
Comment
iBanker

Confirmed User

Join Date: Dec 2004

Posts: 2758
Share

Post
#12

07-29-2005, 03:47 PM

Originally posted by DonovanPhillips

Well, can't say I didn't try....

AaronM tries once a week. You think he would know I have caller ID here by now.

www.JasonandAlex.com
Christopher's ICQ: 268-843-170
Comment
David - PG

Confirmed User

Join Date: Mar 2004

Posts: 767
Share

Post
#13

07-29-2005, 05:04 PM

Originally posted by Doctor Dre

I forgot my pgonzo pass and it was a headache to receive it

We have a password retrieval function. If you do not have access to your original email address however we require some security questions, the last thing you want is your payout sent to some scammer's Epassporte.

perfectgonzo.com
Comment
emthree

Dialer Kingpin

Join Date: Jun 2003

Posts: 10816
Share

Post
#14

07-29-2005, 11:55 PM

Change the payment information and leave a complete traceable trail ... Brilliant.

• Sell Patches & Pills •
Comment
V_RocKs

Damn Right I Kiss Ass!

Join Date: Nov 2003

Posts: 32451
Share

Post
#15

07-30-2005, 12:13 AM

Best practices:

Encrypt the password in the DB using something sweet like MD5 or SH1.

#1, Then when someone types in their password, the login script encrypts what they wrote and checks it with what is in the DB. If both encrypted passwords match, the person typed in the right unencrypted password in the form.

#2, Make your password for the affiliate. If you did #1 correctly and someone can't decrypt your stolen DB, it doesn't matter because they stole the unencrypted DB of your competition and guess what, 85% of webmasters use the same password EVERYWHERE.

#3, Have them create a secret question that must be answered with a phrase. Don't use stupid questions like, what is your favorite color. 70% of the world prefers blue and 98% prefer a primary or secondary color. That leaves only 9 colors to play with and you are in on EVERY account. A better question would be, What is the best part of your lover: and it should be answered with a phrase. She has a great ass. The script would check for a minimum of 3 spaces and a length of atleast 16 characters. This way you know it was a phrase...

#4 Answering it correctly would send an email to the email they signed up with. They should not just get direct access to the account.

#5 Emails must be from ISP's, not free accounts or domains owned by the affiliate. Hack their server and you get to read all their email.
Comment
The Other Steve

Confirmed User

Join Date: Dec 2001

Posts: 2106
Share

Post
#16

07-30-2005, 12:40 AM

Originally posted by iBanker

I put a little thought into that as well, but the fact is most affiliates don't put in their phone number. And its Funny, alot of them have the same number "123456789". They must all live at the same house. I think they think we want to telemarket stuff to them. lol

I really wish more did, it would be easily solved that way.

I understand mate but I find the unwillingness of some people in this industry to use the phone to be amazing. It's the fastest way I know of to get a problem resolved.

We had a minor hassle with a host we use in Holland so we emailed them - two minutes later he rang us and 30 seconds after that the problem was solved.

Try getting that sort or resolution by exchanging emails ...

There is no quicker and surer way to overcome problems but by verbal communication - emails and instant messaging leave too much to chance because important things like the tone of voice are missing.

We did actually have one sponsor call us one day - and it was one of the most helpful and informative contacts we've ever had with a sponsor. It sure beat newsletters and emails.

In our business we often call clients who are about to pay for orders just so they know that they are dealing with real people - it's amazing the difference a phone call can make.

Left intentionally blank ... just like my brain
Comment
V_RocKs

Damn Right I Kiss Ass!

Join Date: Nov 2003

Posts: 32451
Share

Post
#17

07-30-2005, 02:43 AM

You must have been talking to Mike the Bike..
Comment
iBanker

Confirmed User

Join Date: Dec 2004

Posts: 2758
Share

Post
#18

07-30-2005, 10:41 AM

Originally posted by V_RocKs

Best practices:

Encrypt the password in the DB using something sweet like MD5 or SH1.

#1, Then when someone types in their password, the login script encrypts what they wrote and checks it with what is in the DB. If both encrypted passwords match, the person typed in the right unencrypted password in the form.

#2, Make your password for the affiliate. If you did #1 correctly and someone can't decrypt your stolen DB, it doesn't matter because they stole the unencrypted DB of your competition and guess what, 85% of webmasters use the same password EVERYWHERE.

#3, Have them create a secret question that must be answered with a phrase. Don't use stupid questions like, what is your favorite color. 70% of the world prefers blue and 98% prefer a primary or secondary color. That leaves only 9 colors to play with and you are in on EVERY account. A better question would be, What is the best part of your lover: and it should be answered with a phrase. She has a great ass. The script would check for a minimum of 3 spaces and a length of atleast 16 characters. This way you know it was a phrase...

#4 Answering it correctly would send an email to the email they signed up with. They should not just get direct access to the account.

#5 Emails must be from ISP's, not free accounts or domains owned by the affiliate. Hack their server and you get to read all their email.

Those are some great suggestions. I am going to pass them on to my programmer. Thanks a lot!

www.JasonandAlex.com
Christopher's ICQ: 268-843-170
Comment
Nathan

Confirmed User

Join Date: Jul 2003

Posts: 3108
Share

Post
#19

07-30-2005, 10:47 AM

Chris...

hope you'll take a suggestion from me... (no bad blood and all)

Although V knows his stuff, his #3 idea is good but might cause more problems.. I am sure he has his reasons, but I have yet to find a reason why a simple email system is a problem. Meaning:

Simply have them type in the username and the email they signed up with. If the info is correct, send a new password (or the old one if you do not store it encrypted) to their email address on file.

I understand the idea behind the secret question, but like V said, you have to make it COMPLICATED to make it secure. No wonder Paris's Sidekick account was hacked.

The only reason some places have a secret question setup is so that they do NOT have to send an email out on requests. They just let them enter the password again then.

As long as you do not display the password somewhere but email it to the account on file, I see no problem with this kind of stuff.

V, your input on my oppinion would be appreciated.

"Think about it a little more and you'll agree with me, because you're smart and I'm right."
- Charlie Munger
Comment
Antonio

Too lazy to set a custom title

Join Date: Oct 2001

Posts: 14136
Share

Post
#20

07-30-2005, 10:50 AM

my middle name is Edited, gimme your IDs, passwords, and while you're at it CC numbers + the CVVs, thanks
Comment
iBanker

Confirmed User

Join Date: Dec 2004

Posts: 2758
Share

Post
#21

07-30-2005, 10:50 AM

Originally posted by Nathan

Chris...

hope you'll take a suggestion from me... (no bad blood and all)

Although V knows his stuff, his #3 idea is good but might cause more problems.. I am sure he has his reasons, but I have yet to find a reason why a simple email system is a problem. Meaning:

Simply have them type in the username and the email they signed up with. If the info is correct, send a new password (or the old one if you do not store it encrypted) to their email address on file.

I understand the idea behind the secret question, but like V said, you have to make it COMPLICATED to make it secure. No wonder Paris's Sidekick account was hacked.

The only reason some places have a secret question setup is so that they do NOT have to send an email out on requests. They just let them enter the password again then.

As long as you do not display the password somewhere but email it to the account on file, I see no problem with this kind of stuff.

V, your input on my oppinion would be appreciated.

No bad blood at all, and your imput is appreciated. You solution is essentially what I am doing now, so that makes me feel like I'm going the right direction so far.

I'm just blown away that this has happened 2 times in one week!

www.JasonandAlex.com
Christopher's ICQ: 268-843-170
Comment
Nathan

Confirmed User

Join Date: Jul 2003

Posts: 3108
Share

Post
#22

07-30-2005, 11:00 AM

Originally posted by iBanker

No bad blood at all, and your imput is appreciated. You solution is essentially what I am doing now, so that makes me feel like I'm going the right direction so far.

I'm just blown away that this has happened 2 times in one week!

You are right, its scary enough that people try at all.. but twice in a week.. scary...

Anyway, unless V has some valid point against this simpler system, I would definately go with that, I have not seen any flaw in it yet...

"Think about it a little more and you'll agree with me, because you're smart and I'm right."
- Charlie Munger
Comment

Previous template Next

Working...