Printable View
thanks to ray and strongbox, today's password traders were left stranded outside the site :)
after looking over all the options, i'm feeling very good about going with strongbox. no monthly rebills, great protection, good price, fast install - you just can't go wrong using it -
and no, i get nothing for saying this. i just thought that thanks were in order - and anything this good is something webmasters should know about.
I've been using StrongBox over a year now and I have to say it's the best $100 I've spent on my business in 6 years.
I'm not getting paid either and when a product is as superior as StrongBox it needs no advertising as word of mouth spreads like wildfire.
Great job Ray :groovy:
I totally second that !
I left it too long to get a programme of this type installed - but I sure moved quick when my site was on a password trading site and I was suddenly hit with a bill for $3k for just two days worth of traffic.
Within 2 days I had switched my site to another great guy on these boards, Luke at chilihost (who himself was a 1000% help in getting me sorted) and had strongbox installed - end of problem.
I highly recommend anyone who is thinking of doing a paysite to add the cost of strongbox to your start up plan, it will save you fortune !
socks
Chilihost and Stongbox have become an unbeatable combo in this biz. I'm another convert here!
Yup, I always recommend strongbox to all my clients, esp ones that just suffered a password trader episode!
I have recently had the absolute misfortune of dealing with sparta, which is supposed to be the NATS equivalent to strongbox...we have gone back and forth for I believe 6 weeks now and its still not completely setup. Its a total nightmare to install and I would not recommend it to anyone.
strongbox, on the other hand, takes literally 2 minutes to get the server prepped (Ray even sends you step by step howto instructions) and Ray steps in and does the rest and its all majically working within no time. And, technically, it is the best anti-hacker, anti-trader script available too. Win win all around!!!
cheers,
Luke
Glad to see I'm not the only one who likes strongbox! Surprised more people don't use it though
Thanks for posting Basschick, and the others too.
Strongbox and Chilihost do make a pretty good combo - I mention Chilihost
on my Strongbox site because Luke is always so fast at taking care of anything
needed, such as adding the wildcard, and he and his staff really know their stuff.
Whil many installations take a couple of days while we email back and forth with
the host to get the wildcard added with Chilihost we've had sites completed within
15-20 minutes after the webmaster places the order - we can start the installation
as soon as we email Chilihost, knowing that by the time we're done uploading Luke
or one of his staff will have the wildcard done. I sure appreciate the 3 or 4 web hosts
who consistently take care of things correctly and quickly.
I just had a near heart attack when I discovered that we were recently put on a password site and got a bill from my host for over 20x what we usually pay!!!
My hosting company also recommended this solution.....will not hesitate to implement!
BoyNation
Our hosting provider sends us a warning if we're suddenly seeing a spike in bandwidth that it's algorithm thinks will take us over our monthly bandwidth allocation. We had a situation some months ago where we were suddenly burning through bandwidth, and at the time we went with Pennywize because it was easy and near-instant to get working. We're now switching to something else... we have Strongbox and were considering SPARTA, since we have NATS, but with Luke's description, I think we'll probably stick with Strongbox.
I'll second that. Chilihost and Strongbox are an unbeatable combination...It's great to know that you server is in good hands 24/7 with Chilihost and great to know that Strongbox is keeping all the password traders at bay and preventing all of the brute force attacks. I don't know of a better combination out there.Quote:
Originally Posted by Xstr8guy
I'm not getting paid to say this either....but if they'd like to send over a few bucks..or in Luke's case, a beer or two....that's be allright by me!!:high:
Bill
Chip you MAY want to consider Proxy Pass. i have used penny, strong, and proxy.Quote:
Originally Posted by gaybucks_chip
Hard to explain why I prefer Proxy as it is very techincal. Proxy is more expensive, but more server and member friendly.
I know topbucks uses it and I believe sic cash.
It really stops the attack before it even hits your server. Also, members can login as usual, and as long as they have said save my pw then even if they clear caches and all that the pw is still there.
Nothing more frustarting than trying to remember an epoch generated pw for a member.
3 comments here:
proxypass isn't just more expensive - they charge $49 per month so it's ongoing.
epoch doesn't generate passwords - or at least they didn't used to. we had guys earlier this year create logins in epoch like
bigmac
mc1234
and
unicorn
horn1
until your domain is attempted, neither proxypass, pennywize nor strongbox will "know" anything about anything. what's more, proxypass requires an install and a change in your apache, so whatever happens DOES at least partly happen in your server.
Proxy is based on two parts.
1. They have a central server that handles the ip attacks. Thus reducing your server load.
2. Yes, they do install it and it requires a reboot. Basically if the central server is down or you cant communicate it relies on your apache modules to take over the requests. (which is basically what strong box does - relies on your apache modules working with the software that is installed on your server.)
It is more expensive. But it does reduce server load. Allows you to have logins anyway you want.
Topbucks, SicCash and most of the big guys use it.
Concerning passwords - when using strongbox I had many more "what is my password" even when they created their own....
No, the ProxyPass is not a hosted script. The software is distributed as a custom Apache module written in C that is compiled into your Apache binary. As such, all detection and denial functionality is handled on the installed client server. Although the details of its architecture are proprietary trade secrets--and protected as such--, it works by monitoring all authentication request details (i.e. network endpoints, packet header information, HTTP headers, username, transferred volumes, etc.) for compliance with detection thresholds set by the Apache administrator. In addition, the ProxyPass client module queries centralized ProxyPass servers for access to the largest, most up-to-date list of open, abusable proxies. ProxyPass client servers do not search for proxies nor are they doing intensive analysis of network traffic patterns; that work is done on the centralized ProxyPass servers.
For those you get many attacks (asian sites being one) it is worth it.
When I had my asian site I had a PW on at least two boards every day and it spread from there. MOST of the boards were in Chinese.
Proxypass does seem to be a bit better than most of the others, which are
strictly naive IP counters. It doesn't do quite the same analysis as Strongbox 2.0
and Strongbox 3.0, currently in beta, is a lot more sophisticated, but at least
Proxypass does more than just count IPs per day. The monthly expense is an issue,
and being an Apache module implies several siginificant drawbacks compared to Strongbox -
it may not work with a lot of shared hosting accounts, it can't be as easily moved to a
new server, etc. Personally, I'd prefer to design the system so as to minimize processing
overhead and keep the processing on the web server rather than constantly sending data
back and forth with their server, but I understand that design decision since they charge
a monthly fee. It's hard to charge a monthly fee once you hand over the full software
and that's one reason Strongbox doesn't cost $50 / month. There would be no way to
actually collect the $50 since the system doesn't rely on an external server.
Anyway, if Strongbox didn't exist I might well choose Proxypass for a busy site where
it was worth the $50 / month fee to have something that does a bit more than just count
IPs, but Strongbox does some pretty smart analysis that noone else can touch right now
and with the new stuff in Strongbox 3.0, including a basic biometric test, there's nothing
else out there that can so effectively stop shared passwords. We've gone from fairly
accurately indentifying a specific computer to actually including indentification markers
for the human being sitting at the keyboard so we have an indication if two people using
the same computer access the site or if the same person accesses the site from more
than one computer and I don't expect Proxypass or anyone else to be able to match that
any time soon.
biometrics....this sounds wicked. I would love to know more!
cheers,
Luke