Questions regarding pennywize password protection. paysite owners pls reply
 

Hi guys,

I'm just curious as to why passwords are shut off by pennywize. More specifically, how many of the passwords that get shut off are from legitamate users? I know that AOL dial up users are counted as a subnet each time they log in and they get shut off often. I know some are brute forced too. But some people swear up and down that they never traded their passwords when it gets disabled, and I reset a new one and in a few days, there it is again, shut off. Now this wasnt such a big deal when my sites were small, but now its a pain in the ass. 2-3 hours a day resetting passwords and mailing them to members. I was thinking that spyware could play a role in this. Do you think these members could be victims of spyware and are telling me the truth, or they are lying to me. Pls let me know.
Duke

i think they're lying, but i suggest you talk to pennywize support.

pretty much every user who told me he didn't do it, i found referring urls on password sites with his username and password listed. also many unique visits on my stats, which isn't just about subnet, i don't think.

Just because the user didn't share it doesn't mean it wasn't compromised. Some users pick stupid, easy to guess, user names and passwords. Many often use the same user/pass for every site they join, so just because they didn't specifically give yours away, they may have given it away in the past for a different site.

I usually check the logs to see where the logins are coming from and make decisions on how to treat it. Also, if you KNOW you have an honest user AND they are a good rebilling customer, you can tell pennywise to ignore that username. It's not something I would recommend, but it's an option.

Thanks! good info
Duke

great topic Duke. Anyone else have input?

-p

basschick and Bigjohn covered it beautifully.

They did, but i'm sure there is plenty more to be covered.

Duke