Hack protection-->pennywize addon would be nice, is this already in the market? - GoFuckYourself.com - Adult Webmaster Forum

X

justsexxx

Too lazy to set a custom title

Join Date: Aug 2001

Posts: 13723
Share

Post
#1

Hack protection-->pennywize addon would be nice, is this already in the market?

01-23-2003, 01:27 AM

Hi,

Question, I'm thinking of using pennywize for protections against password trades, and brute force attacks.

BUT, now I understood, you have to create a new password for the members who did get out of the DB, and email him/her.

Is there a way when a passwrd het blocked, an email is send automatically to the "real"member, and in this email, the reason, and the new passwrd is included?

Andre

Questions?

ICQ: 125184542
Tags: None
Danielle

Confirmed User

Join Date: Jun 2002

Posts: 1227
Share

Post
#2

01-23-2003, 01:34 AM

That's not really a good idea if you use pennywize or even our product Stop That Hacker http://www.stopthathacker.com

For the following reason.

Once you stop brute force attacks 99.99% of all your password sharing is from the member giving out his password or from credit card fraud. So why email him a new password so he can give it out again? Make him explain why he gave it out in the first place.

Plus most password sharring ends up in a chargeback anyway.

So kill the account. Kill the rebilling and forget it.

Hugs,
Danielle
Comment
salsbury

Confirmed User

Join Date: Feb 2002

Posts: 1070
Share

Post
#3

01-23-2003, 03:16 AM

i'd suggest letting them reset their password up to twice, and then after that, have them explain it. send them an e-mail with a link they have to click to reset the password and everything. maybe even generate the password for them at that point.
Comment
goBigtime

Confirmed User

Join Date: Nov 2002

Posts: 7761
Share

Post
#4

01-23-2003, 03:19 AM

Originally posted by Danielle

So kill the account. Kill the rebilling and forget it.

Great advice
Comment
justsexxx

Too lazy to set a custom title

Join Date: Aug 2001

Posts: 13723
Share

Post
#5

01-23-2003, 03:58 AM

Originally posted by Danielle
That's not really a good idea if you use pennywize or even our product Stop That Hacker http://www.stopthathacker.com

For the following reason.

Once you stop brute force attacks 99.99% of all your password sharing is from the member giving out his password or from credit card fraud. So why email him a new password so he can give it out again? Make him explain why he gave it out in the first place.

Plus most password sharring ends up in a chargeback anyway.

So kill the account. Kill the rebilling and forget it.

Hugs,
Danielle

I don't agree on that. Also Brute password hackers do get the passwords of the legit members. Killing them would be stupid then!

BTW your program, why is that better then pennywize? You have sites using your script?(because the price is so low, and the design of your site is not so good, makes me suspicious. A demo would be great

ANdre

Questions?

ICQ: 125184542
Comment
JimW

Confirmed User

Join Date: Dec 2002

Posts: 422
Share

Post
#6

01-23-2003, 07:20 AM

what are you thoughts on the effectiveness of http://www.passwdcop.com/

?
Comment
justsexxx

Too lazy to set a custom title

Join Date: Aug 2001

Posts: 13723
Share

Post
#7

01-23-2003, 07:50 AM

Originally posted by JimW
what are you thoughts on the effectiveness of http://www.passwdcop.com/

?

Looks like it only protects you from password traders. I don't see anything over 3 failed logins etc...

500 dollar looks a bit pricey to me for that feature....

Andre

Questions?

ICQ: 125184542
Comment
CrazyNakedChick

Confirmed User

Join Date: Mar 2002

Posts: 1902
Share

Post
#8

01-23-2003, 07:56 AM

i tried pennywize about 4 years ago or so, stopped using them.

i didn't like the way they jerked my 401 traffic to their benefit -
ads pages. their service works well, i just thought paying them *and* giving them hits to their 401 pages excessive....even if it is crap traffic. ;)

they may have stopped taking everyone's 401 traffic by now, for the record i can't say as it's been years since i messed with them.

Addicted to Lingerie? Got Broadband? Click Here!
Comment
Jizar II

Confirmed User

Join Date: May 2001

Posts: 1425
Share

Post
#9

01-23-2003, 08:10 AM

Originally posted by justsexxx

Is there a way when a passwrd het blocked, an email is send automatically to the "real"member, and in this email, the reason, and the new passwrd is included?

Andre

I think this is a great idea, and I was actually in the middle of getting such an solution made, I think the easiest way is to have the member info in a DB.. so you can keep track of how many times you have issued a new pass ect. I also disagree with Danialle.. killing all blocked accounts would be very stupid.. in our case most of these are legit users who never get blocked again after we give them a new password.
Comment
OneHungLo

So Fucking Banned

Join Date: May 2001

Posts: 40902
Share

Post
#10

01-23-2003, 08:24 AM

Originally posted by Danielle
That's not really a good idea if you use pennywize or even our product Stop That Hacker http://www.stopthathacker.com

For the following reason.

Once you stop brute force attacks 99.99% of all your password sharing is from the member giving out his password or from credit card fraud. So why email him a new password so he can give it out again? Make him explain why he gave it out in the first place.

Plus most password sharring ends up in a chargeback anyway.

So kill the account. Kill the rebilling and forget it.

Hugs,
Danielle

Not even close...99% is from hackers hacking the password file and stealing the passwords.
Comment
justsexxx

Too lazy to set a custom title

Join Date: Aug 2001

Posts: 13723
Share

Post
#11

01-23-2003, 11:38 AM

No programs capable of doing that?

Andre

Questions?

ICQ: 125184542
Comment
boldy

Macdaddy coder

Join Date: Feb 2002

Posts: 2806
Share

Post
#12

01-23-2003, 11:57 AM

I once wrote a possible solution for free

http://www.kimhollandcash.com/bforce.php

tata ..

MacDaddy Coder.
Comment
BrutalMaster

Confirmed User

Join Date: Oct 2002

Posts: 256
Share

Post
#13

01-23-2003, 01:09 PM

Pennywize now lets you direct the failed logins to a different URL.

I use Pennywize, these days I simply wouldn't be without some sort of password trader/brute force protection.

What I've been doing is killing the accounts of people who obviously have compromised passwords and sending them an E-mail asking them to get in touch so I can issue them a new ID/PW. I've found that the people how get in touch never seem to have another problem, leading me to believe their ID/PW was hacked by someone else, not traded by them. The ones who don't get in touch (who have also been consistently the ones with PW/IDs coming form the most subnets) tend to chargeback.

The conclusion is that the worst offenders buy a site, then trade that PW/ID on a board, and when they get caught, they charge back.

Again, another example of VISA and MC not giving a shit about people who are just criminals as long as they are cardholders.

Brutal

"Don't worry, I won't bite...oh, wait a minute, I forgot, yes I will."

www.brutalmaster.com
Comment
Danielle

Confirmed User

Join Date: Jun 2002

Posts: 1227
Share

Post
#14

01-23-2003, 07:47 PM

justsexxx,

We have sold tons of copies at over $300.00 and never had a complaint. Yes the site design sucks. LOL The program has been around a long time. Stop That Hacker runs 100% on YOUR server! So you don't have to worry about the other guy being down.

The price was reduced so no one with a paysite could ever say they can't afford a password hacking solution.

Not sure about the others but ours stops HEAD brute force attacks at 0 tries! If a head request (The most popular type of brute force hacking) is received to a protected area it is sent to /dev/null and not even responded to.

OneHungLo,

If the hackers are getting your passwords what ever you are using to stop brute force attacks must really suck. Or are you forgeting to protect things like formmail.pl on your site?

Hugs,
Danielle
Comment
wwwcashmountain

Confirmed User

Join Date: Dec 2002

Posts: 194
Share

Post
#15

01-23-2003, 07:58 PM

Hi

We use pennywize on all our sites, it's teriffic, and i would hate to live without some kind of protection.

Their new version 3 allows you to redirect all your abused traffic to a URL of your choice - which is pretty kewl. It's only 401 traffic, but still.

Their version 3 one has way improved brute force protection too - Steve showed me how it worked once and it was a real eye opener. Anyway that's my $0.02!

thanks,

Robert

SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, then you may use a 624x80 instead of a 120x60.
Comment
justsexxx

Too lazy to set a custom title

Join Date: Aug 2001

Posts: 13723
Share

Post
#16

01-23-2003, 10:16 PM

Originally posted by Danielle
justsexxx,

We have sold tons of copies at over $300.00 and never had a complaint. Yes the site design sucks. LOL The program has been around a long time. Stop That Hacker runs 100% on YOUR server! So you don't have to worry about the other guy being down.

The price was reduced so no one with a paysite could ever say they can't afford a password hacking solution.

Not sure about the others but ours stops HEAD brute force attacks at 0 tries! If a head request (The most popular type of brute force hacking) is received to a protected area it is sent to /dev/null and not even responded to.

OneHungLo,

If the hackers are getting your passwords what ever you are using to stop brute force attacks must really suck. Or are you forgeting to protect things like formmail.pl on your site?

Hugs,
Danielle

Okay, well I'm not a security expert Can I email you, or talk with you on ICQ?

Andre

Questions?

ICQ: 125184542
Comment
drunkdollars

Confirmed User

Join Date: Apr 2002

Posts: 2734
Share

Post
#17

01-23-2003, 10:20 PM

proxie-pass.com

I think I post this once a week It saved us from a $1000 a day hacked pass problem

SIGS ARE GAY

98055668 icq
Comment
Danielle

Confirmed User

Join Date: Jun 2002

Posts: 1227
Share

Post
#18

01-24-2003, 12:40 AM

justsexxx,

I can do one better. My husband created the script. You can reach him at [email protected]

I told him to expect your email.

Hugs,
Danielle
Comment
justsexxx

Too lazy to set a custom title

Join Date: Aug 2001

Posts: 13723
Share

Post
#19

01-24-2003, 02:27 AM

Originally posted by Danielle
justsexxx,

I can do one better. My husband created the script. You can reach him at [email protected]

I told him to expect your email.

Hugs,
Danielle

Okay I mail you later today

Andre

Questions?

ICQ: 125184542
Comment

Previous template Next

Working...