PASSWORD SHARING ALERT TO ALL PAYSITE OWNERS!!!

[frankthetank]

Originally Posted by [BV]

... as 99% of shared passwords are not shared by the owner.

That´s interesting but I have to admit I can´t follow. If the owner of the password doesn´t share it, where do they get it from?

Is it a guess or do you think they use spy software?

I´m not familiar with those problems because I don´t run a pasite yet, but I´m building one. So it´s an interesting part for me.

[spazlabz]

Originally Posted by frankthetank

That´s interesting but I have to admit I can´t follow. If the owner of the password doesn´t share it, where do they get it from?

Is it a guess or do you think they use spy software?

I´m not familiar with those problems because I don´t run a pasite yet, but I´m building one. So it´s an interesting part for me.

there are programs out there for people who really enjoy hacking paysites that make it very easy
hackers comes along and wants to se your content or show off that he can 'hack' a site all they need is;
the right software (extremely easy to get)
a descent sized word list
your members URL (http://www.yoursite.com/members) authorization failed provies this quickly
5 proxies (again easy to find)

you get get literally dozens of working U/Ps in under a minute esp if the site has been around for awhile. New sites are harder to hack like this.


spaz

[[BV]]

Originally Posted by frankthetank

That´s interesting but I have to admit I can´t follow. If the owner of the password doesn´t share it, where do they get it from?

Is it a guess or do you think they use spy software?

I´m not familiar with those problems because I don´t run a pasite yet, but I´m building one. So it´s an interesting part for me.

Yes, basically I would classify it as a guess, that's why you do not want your members picking their own passwords.

You want to generate them a random pass. Makes it much harder for the hackers and their scripts to guess. They basically try thousands and thousands of user pass combos on your site until they find one that works. Another reason why you want to use something like proxypass. After one IP tries to log in unsuccessfully after so many times it bans that IP for a period of time.

Now as far as the old user pass, if someone tries to log in using the shared combination again, you send them to a fake members area.