Too Much Media seeks beta testers for SPARTA - members area protection/auth program
 

Too Much Media, the makers of NATS, are currently seeking a few people to beta test our newest application, SPARTA.

SPARTA is an Apache Module which takes over the work systems such as mod_auth or the like normaly handle. It does NOT use HTTP auth for authentication, but instead uses a 128bit session key which stores user data. It also lowers load on your servers by not checking the password on every single connection, but instead only periodically. Of course SPARTA also includes anti password sharing and anti brute force measures to benefit the specific needs of adult industry.

Logins take place via a normal HTML form rather than the popup box provided by HTTP auth. In addition to the username and password fields you may add a verification string in an image. This is the random string of letters shown as an image that a user must type in order to login. You often see this on the registration forms of many sites to avoid repeated automated registrations. Now this can be used to greatly reduce abuse by brute force hacking, etc.

A sample verification string image similiar to what would be shown on the login page and typed by the user along with their username and password to login:
http://www.toomuchmedia.com/sparta_image.jpg

With the use of session auth rather than HTTP auth the viewing of videos by a member will be made easier. The video player will no longer have to ask the user to login again and reauthorize them when they try to view a video.

Currently while in testing SPARTA only supports apache v1. v2 will be fully supported once testing is finalized.

We are looking for roughtly 3-5 beta testers who will receive lifetime use of the program for free.

Any feedback or feature suggestions from anyone at all is greatly appreciated.

You do not need NATS in order to use SPARTA. However if you are a NATS customer SPARTA will communicate with NATS to simplify and expand member management. Login statistics and other valuable data and features will be provided to NATS by SPARTA and vice versa. For example, fraud scores will increase for resellers with a higher than normal percentage of members that do not login and SPARTA will log everything associated with a member in his surfer stats inside of NATS.

Another benefit to using sessions instead of HTTP auth for member authentication is that the session can carry data other than simply username and password. If you are a NATS user along with SPARTA once a member logs in you will have access to his Name, Zip Code, Join Date, etc. within your members area to further personalize and enhance the member's experience.

If you are interested in beta testing this program please contact albright * toomuchmedia * com and I will be back in touch with you on Monday or Tuesday or feel free to icq me over the weekend at 5596373.

Thanks everyone!

good stuff

Looks like I'l be testing this one

When users are logged in is it as a session that expires after "x" amount of hours? Would be nice to see a solid solution to stop site rippers.

The session will be reauthenticated every X seconds (you can set that), and if it is unused for Y seconds it will disappear, yes.

If you have some ideas regarding site ripping, let us know, would gladly integrate it

Hitting you up now Nathan.

sounds like this could be a nice piece of code ;)

I know there is a login script that plants a cookie once the member logs in, and you can set the cookie to expire in a certain amount of time so the user has to log in again. It seems like a good idea, but if a member has cookies disabled it won't work. You also have to install an apache module on the server in order for it to work, which some people may not be able to do if they are virt. hosting.

But something like that that works for every browser etc. would be great. I've seen a few other attempts to stop site rippers, but they seem more of a bandaid than an actual solution.

It would be difficult to completely stop, but if you make it enough of a PITA for a ripper to download your members area, he will probably just move on to another site. :2 cents:

Couple more suggestions.

You should code a control panel to change thresholds, add new member areas, new sites etc. rather than having to edit a perl script or config file for each domain through ssh etc.

Also, being able to have certain domains access the members areas would be a good idea too. Setting a token or something similar would kick butt as using referring headers is a bad idea. :)

The only real way of doing something like this would be to limit bandwidth the client can use, and that is not easy...

I will definately think about it though.

Mainly though, SPARTA is for authenticating members and for making sure passwords are secure.

SPARTA is an apache module, turning it on for any virtual server is fairly straight-forward. Because of the nature of being a html based login page, you have to setup at least that page though to make it work.

There will of course be a control panel for thresholds, either standalone or if you have NATS it would be an option in NATS.

Regarding the token stuff, I am looking into the best solution to let "friendly" surfers in unauthorized, but it of course always is some kind of a security risk. But I am looking...

*3am bump*

We are a bit busy to beta test it John sorry but when you release it we'll probably buy it. You guys code up the best products! Look forward to trying the final version.

John/Nathan.. I posted a ticket on this. Thanks!

And this will be a reliable option on bigger load balance setups?

Very interested to know more.

Sounds good guys!

Bump for PBucksJohn :)

Yes, we are currently making sure that a multi-server environment will be no problem for it.

The most important thing for us is performance, so multi-server possabilities is obviously a must.

The system is 100% apache module, no rewrite rules, no perl scripts, or anything like that. The only thing that is not in the module is the actual login page, that one can be any programming language you can dream of, the system does not care.

Great news and as soon as its ready to roll please do hit me up on ICQ: 337 208 349 or email: office 'at' sgs-webmedia 'dot' com we would like to be one of your first customers please. :)

added you to icq..

Thanks. :)

excellent :thumbsup