Which password protection software?

[Ludedude]

I don't have a lot (read: none) of experience with password protection software for a paysite.

What do you guys use and why? I need to buy some ASAP so I'd like some recommendations with pros and cons.

[rollin2]

pennywise
i believe its at pennywise.com

it is the #1 used password software
its great and very customizable

[pr0]

Pennywize

Is known for being harder to crack than the average protection.

I've actually talked to crackers who've quoted it as being the hardest for newbie crackers to hit.


You wont be able to stop the hard-core crackers, but pennywize is good for all around protection.

[AaronM]

Combine "pennywise" with "stop the hacker."

[Ludedude]

The drawback to pennywise for me, though, is the whole thing sits off site...I don't really want to rely on someone elses server processing for me.

[SykkBoy]

we use "Stop That Hacker" too..and I think punky combined it with something else as well, but not sure what...

I personally like "Love Brick"...some password cunt grabs a couple passwords, I track them down and smash them in the face with the brick of love...then I steal all their cabbage and whiskey...

[AaronM]

Originally posted by SykkBoy2
we use "Stop That Hacker" too..and I think punky combined it with something else as well, but not sure what...

I personally like "Love Brick"...some password cunt grabs a couple passwords, I track them down and smash them in the face with the brick of love...then I steal all their cabbage and whiskey...

LMAO

[pr0]

hahahahahaha

i like the "dick in the mouth" protection

i find their mothers/sisters & stick my dick in their mouth

It's 99% effective......except for the few freaks who get into watchin my do their momz/sis.

[bhutocracy]

Originally posted by SykkBoy2
I personally like "Love Brick"...some password cunt grabs a couple passwords, I track them down and smash them in the face with the brick of love...then I steal all their cabbage and whiskey...

heheheh

[corvette]

Tried Iprotect? Works like pennywize, sits on the server


works pretty well for us

[erotictrance]

Yeah. Well what about all of these proxy servers that everybody complains about?

Apparently, these programs don't work with those ...

At least if I recall reading other recent posts correctly ...

[BV]

For those of you that use ccbill they have a script that handles password sharing but not bruit force attacks, my friend looked at it and said it looked pretty good.

I'm running a custom script written by this same friend. He called it apachewatch. You need to be running your own linux box to use this one. but it has worked like a charm for trading and brut force.

I didnt want to use pennywise because I talked to a few hackers and they just laughed. and like Ludedude says it sits off site so if they go down you go down and it is another monthly fee. The plus is it's probably perfect for smaller sites on shared servers and shit like that.

[Ludedude]

Cool...I've got about 5 different ones to check out. Prices on these things are all over the board from $50 to $500...go figure. I'm definitely in favor of a program that 1) I dont' rent and 2) that will work with CCBill (or at least not interfere with it).

[BV]

Here is the url for ccbill's password tracker skript for password trading:

http://manual.ccbill.com/password_tracker.htm

[Plugger]

As far as I know, most of the passowrd protection software works on several priciples. One, they track a username and the number of attmpts to get a vailid passoword. After X negative attemps they block the username for a while. Another is to track the amount of negative results by IP. Again, if a single IP tries several user:pass combos and fails, the IP gets blocked. This is most common.

Then there is the password trading aspect. If a user:pass is used by too many different, IPs then the user:pass is blocked for a while. This is a tricky number to set because of the number of AOL proxies that are out there.

So most of the software, pennywise, Iprot, do a good job against traded passwords, but as for the single user that gets a pass, he can still get in. Also, unfortunately, when the software blocks an IP it is usually a proxy, so not just 1 user gets blocked, but tons of users do.

Plain and simple if a intermedite hacker wants in, he will probably get in. Most will rotate thru proxy servers so the IPs will never get blocked, and they will use extensive user:pass files so they never try the same username more than once.

You would be surprised how many sites you can hack with the deafult user:pass files that come with most of the basic hacking programs.

The bottom line, get something that blocks the mass trades and move on to something else. Iprot seems to do well.

Beware of scripts that use HTTP_REFERER. That can be easily spoofed!

[cgiGeek]

Plugger know his shit,
only on note: messing with HTTP_REFERER can only be done with access to the local area network of the referer, so it does not count as a real danger to any password authentication script.

[leverage7]

I use Ovelo Sentry - http://www.ovelo.com
Only $19.95 and very easy to use.

[Danielle]

Stop That Hacker is more expensive then most, but for a very good reason.

Well supported and it WORKS!

It will handle proxy attacks very well. It also stops HEAD attacks that get around some scripts very well.

Here is the URL.

http://www.stopthathacker.com

And yes I am biased a bit since my husband created it.

Hugs,
Danielle

[Gramma]

Stop that Hacker is the best. I use it combined with pennywize .. but I don't think you have to have them both.
I'm just paranoid