Printable View
Is Strongbox the best (and only?) answer?
I’m with CCBill and they don’t provide any password protection per se. So what should I be using to prevent multiple people using the same password? Or any other protection I may need against password and content theft that I don’t know about (and would rather avoid than to find out the hard way)?
Thanks a lot guys!
Allan
It is very expensive. No, it is not the only and/or best answer. Do you know Password Sentry?
i hear good things about proxypass from people who use it - very good things, actually. and there's also pennywize. strongbox is a good solution, too, and an inexpensive one-time charge while the other two i mention here are recurring.
The one-time charge was actually the deciding factor for me in getting StrongBox over PennyWize although, even that right now is becoming to much to spend with every site i launch so im actually looking at getting a custom solution created that ill only have to pay for once and use an unlimited amount of times.Quote:
Originally Posted by basschick
Regards,
Lee
But doesn't Strongbox have that really annoying feature where you have to enter the "code" in the box every time you enter the member's area? like what you see on this site http://www.shanesixty.com/memberslounge/
or is there a way not to have that feature?
can you guys point me to some other sites that also use Strongbox? Just want to see what the setup looks like.
thanks
allan
Allan,
That 'annoying feature' is actually what stops password traders etc.
You can customize the look of that page though (which is something i havent actually got around to doing yet lol) :)
Regards,
Lee
strongbox is the best, toomuchmedia also has a product out but i haven't heard of anyone using it yet.
alexbucks, I don't think a one-time fee of $150 is expensive at all????? Its cheaper than most good quality CMS systems or other adult-targeted scripts.
Allan, as for the code, you can disable that but its not recommended, as Lee says, its part of the reason its security is better than most others.
We used to use Pennywize, then switched to Strongbox.
No comparison.
Strongbox is very robust and protects content in a number of different ways, not just by preventing password sharing. It is very sophisticated in the algorithms it uses to temporarily disable, and then, if abuse persists, permanently disable passwords.
The CAPTCHA code can be disabled if not wanted, but frankly, we've had no complaints from users about it.
We've had several programmers say they could replicate Strongbox's security "easily" but when they actually look at everything it does, suddenly they aren't nearly so confident. Honestly, for $150 or whatever it costs, it's pretty cheap insurance against bandwidth theft and shared passwords.
I highly recommend it.
You actually have several options with the Turing Image feature.
You can even turn it totally off if you want to, but you have a
range of options where you can use the extra security without
annoying your customers, so you'll probably use it in some form
after considering all of your options.
As you can see on the site you mentioned, shanesixty.com, the
Strongbox images are not the annoying ones like on Yahoo.com
that are very hard to type correctly the first time. Instead, Strongbox
always uses a simple English word, displayed in pretty clear letters.
The words aren't quite clear enough to be read reliably by OCR software,
but are easy to read even at 3:00 AM when your eyes are tired.
I've been closely tracking OCR software development for 15 years
what what I found out is that there just really hasn't been that much
development. OCR wasn't very good 15 years ago, it's not very good
now, and there is no reason to believe it will be very good in five years,
so there's no need for the annoying, hard to read images with 10 random
characters. Over the years we've heard only one user complain about
the Turing Image, a partially blind person. We took care of him, of course,
but more on that later. For those who want a little bit more security against OCR,
which we don't see hackers using anyway, we have a couple new types of
images you can choose along with the default you see on shanesixty.
Default:
http://bettercgi.com/tmp/turings/PLACE.gif
Tie dye:
http://bettercgi.com/tmp/turings/STAND.gif
Segmented:
http://bettercgi.com/tmp/turings/QUIRK.gif
http://bettercgi.com/tmp/turings/WIVES.gif
http://bettercgi.com/tmp/turings/DUNKS.gif
As I mentioned you can also turn them off entirely if you think users will
have trouble typing a word, but you can also avoid any trouble for your
users AND scare off potential attackers with "bluff mode". Using "bluff mode",
potential attackers see the Turing image and leave to go attack an easier
target who doesn't have this protection, not knowing that the word doesn't a
ctually have to be entered correctly - it's just a bluff. :)
Oh and of course for our vision impaired porn afficionados:
Another option
I think you'll find that there are a lot of guys who started playing around with PHP a
couple of years and ago and figured they'd start selling a simple IP counting script
along with the other scripts they sell, but you won't find anyone else who has put the
kind of thought and research into protecting your site that the Strongbox developers
have for the last ten years. We don't sell an affiliate program script, a submission
script, or a shopping cart script. We spend 40 hours a week, every week for years,
finding the very best ways to protect your site. From our role in the development of
the initial .htaccess that has been used to protect almost every AVS site since we
published the code on our site in 1997 up until the upcoming release of Strongbox 4.0
with biometric indicators, we do one thing - research the best ways to protect your site.
That's what we do, what we've done for years, and what we do well.
You can play with some cute little IP counter if you have a little hobby site that you
enjoy working on, and in fact I would encourage you to do so, to get a feel for what
the business was like back in the late 1990's. If you build a professional site that
you intend to make a living from, I would strongly suggest carefully considering
professional tools and systems. Not just security - that means regular backups so
you don't lose your business due to a hard drive failure or hacker, a truly
professional web host like Chilihost to keep your servers fast and reliable, and
reliable payment processing. At that level you also may want to consider what
happens when your site gets listed on the big password sites and you get a
bandwidth bill for $650 for the first night, while at the same time your customers
can't use the site because of the load. At some point, when your site is truly a
professional site providing you with real income, you'll want to use a professional
security system to protect it.
I forgot to reply to this part, asking about other types of protection.Quote:
Originally Posted by GPallan
When using CCBill or most other major processors, your passwords are
"encrypted" using an extremely old and weak type of encryption that can
be cracked in seconds. While it doesn't happen as frequently as brute force
attacks and password sharing, when a cracker downloads your whole password
file and posts ALL of your passwords on passwords sites it's a huge pain in
the ass. You have to issue a new password to each and every user. One
of the best ways to prevent that is to upgrade your CCBill script to use
strong encryption. It's a simple upgrade we can do for you for $20.
As far as content theft, put your URL on your content so when/if it's stolen it becomes
free advertising. Images can't really be protected from theft and redistribution on an
internet site. On an INTRAnet site it's possible using some software we wrote for a
major research university many years ago, but it can't be done in a platform independent
manner. Videos can be protected to some extent with DRM, but I don't suggest it.
DRM is not platform independent, it's Windows only. I don't think it's worth giving
up the 10% of your customers who wouldn't be able to play your videos. It also
offers essentially NO protection at all since it can be cracked by any eight year old
using a point and click program like http://www.dvd-tool.com/drm-removal.html .
Both Microsoft's DRM and Apple's were cracked very quickly, I believe one of them
was cracked before it was even officially released, so that tells you how effective that
approach is. Besides that fact that with DRM you have to pay money out of your pocket
every time someone watches one of your videos. If I were running a site I'd prefer to
keep the 10% or so of customers who can't watch DRM "protected" video conveniently
and just put my URL on the videos, then HOPE they get out on the peer to peer
networks to provide free advertising.
All that said, there are certainly some intelligent people who use DRM, and they
may have good reasons for doing so in their own business if they have extremely
unique content or somethign like that. Generally for a porn site, though, I'd say
just put your URL on there and spend the time thinking about marketing rather than
content theft.
After all that I actually have still more to say about the subject, if you can believe that.
In my opinion, while it's good to have some of your images and videos floating around
with your URL on them, ideally you would NOT have someone go in and just download
huge sections of your site and post it somewhere, a practice called "ripping".
Strongbox provides two features that provide some protection against such ripping.
(On the Strongbox site you'll see it called "slurping", the term we used before
"ripping" was invented".) For further protection against ripping you can use our
only other product, Throttlebox, which is designed just for that purpose. If your
site is fairly small at this time the protections built into Strongbox are probably enough,
though.
wow...you've answered every questions that i had (and also the ones that i didn't know i had) regarding Strongbox. THANKS!!Quote:
Originally Posted by raymor
I’m buying my copy right now :D
I'm glad I could be of help. I'll be looking for that order form.Quote:
Originally Posted by GPallan
Just let us know if we can be of any further assistance.
Raymor...i purchased a copy for my site www.dixter.com. But it's saying that it's going to take three days to set it up. I'm experiencing some password hacking/sharing as i'm writing this! Is there anyway so set it up right away? Please let me know would really appreciate it. ThanksQuote:
Originally Posted by raymor
Allan
Allan,
I represent a password protection system called
Phantom Frog that is setting a new standard for
password security. Our product uses Geo-IP tracking
technology which will not even allow 2 people to
share the same password let alone a whole trading
forum with hundreds of leechers!
Our High-Resolution Geo-IP Tracking offers the most
accurate password abuse detection available anywhere.
It tracks all visits to the members area of a site
down to the city level. Furthermore, it takes
latitudal and longitudal data into consideration.
Therefore, Frog detects the fact that the same
password was used in L.A. and NYC. We pinpoint the
abuse instantly, allowing for the possibility of
legitimate travel. That level of resolution is unique
to Phantom Frog (yes Ray, it was worth mentioning).
Our system is based upon the premise of providing
24/7 uninterrupted access to the legitimate members
while blocking out the leechers. This is accomplished
automatically through our unique Automated Member
Support (AMS) feature. AMS re-issues a new password
directly to the affected members. This strategy breaks
the cycle of password abuse and frees up the webmasters
to do more important work.
Please check out one of our latest press releases at:
http://forums.gaywidewebmasters.com/...334#post190334
Our product is integrated with CCBill, NetBilling,
Paycom, NATS, MPA3, Verotel, 2000Charge, SegPay, Jettis,
and 365Billing. Phantom Frog has a simple FREE Trial
Version which installs by adding one html tag or we
can handle the installation completely for you for.
In fact, we recommend that you leave ProxyPass or
Pennywize activated during our Trial to witness
first-hand all the abuse being missed by them!
Most of customers were motivated to purchase our
password protection only 3 days after installing the
Free Trial! We also offer Automated Member Support,
Brute Force Attack Protection, and Bandwidth Abuse
Protection.
Phantom Frog has stellar webmaster testimonials which
are listed on our site. A high percentage of our clients
are ex-ProxyPass/Pennywize clients. A casual scan of
our webmaster testimonials page will reveal how unaware
they were of the password abuse which was being allowed
and overlooked by their current protection system.
Please feel free to contact me with any questions or feedback.
Visit out site to learn more: http://www.PhantomFrog.com/g
Visit this link to try our FREE demo: http://phantomfrog.com/g?ft=1
Thanks
George
Email: George@PhantomFrog.com
ICQ: 226948212
Thanks, George. I'm going to give your free trial a try. Thanks for the quick solution
Allan
Hi Allan,
We appreciate you checking out Phantom Frog. You
have my cell phone / ICQ / email information. Please feel
free to contact me over the weekend and we'll get you
lined up with the FREE Trial or the full production version
to solve your immediate problem. I've notified the owner/
developer Bill to be on the lookout for your Trial request.
Many Thanks
George@PhantomFrog.com
ICQ: 226948212
I think the message says it could be up to 2-3 days.Quote:
Originally Posted by GPallan
For the last eight months or so, since Ali joined us, most installations are done
the same day if they are ordered by 5 PM, or the next day otherwise.
Anyway, it's already done on your site.
George, don't be an asshole. I've been very nice to you, even as you repeatedlyQuote:
Originally Posted by gmr324
commited criminal acts against us and the webmaster community at large.
I haven't even responded to your BS by telling your three "dirty little secrets" about
your "Geo-IP" and why it's "unique", which of course means you guys are the only
ones crazy enough to rely on that mess. I think I'm still being very nice by keeping
this stuff to myself, so don't push me by deliberating being an asshole.
You know, I think, that if you really insist on continuing to try to piss me off all I'd
need to do is send the URLs of a couple of these posts to "MM" and they'd
file suit in federal court immediately, which would be the end of your company.
Play nice man, I have.
Ray,Quote:
Is Strongbox the best (and only?) answer?
I was responding to an open request for information
about password protection systems. The operative phrase
in Allan's request above is "(and only)" meaning are
there other viable alternatives to Strongbox. Allan
is entitled to receive meaningful information on all
his options in a professional and timely manner. In
fact, I'd be doing Allan a disservice by not responding.
We are firm believers that webmasters should make
well-informed decisions by visiting all the respective
sites that deal with website security systems. In fact,
we encourage webmasters to run a Free side-by-side
comparison of Phantom Frog with their current system and
let Frog sell itself. I don't see any other people
making that open-ended offer to the webmaster community.
I am not going to dignify your name-calling by responding
to it because such primitive retort and demeanor speaks for
itself. The webmaster community which represents our client
base is passionate and exceedingly satisfied with our system.
My only concern is the adjectives that our clients and
prospective clients use to describe me and Frog. They
represent the "true judges" here.
Phantom Frog has been in business for over 4 years and will
continue to grow and extend our reputation and market
penetration as a leading-edge solution for password protection.
As such, I will continue to post information and educate
people about Frog every opportunity I get. Being aware of
how innovative, reliable, and effective Frog is in password
protection, it would be a "criminal act" for me not to spread
the word!
George I have no problem with you posting. You've posted in every single threadQuote:
Allan
is entitled to receive meaningful information on all
his options in a professional and timely manner.
where someone has mentioned Strongbox on any of at least a dozen boards and
I've never had a problem with that. We have already discussed the issue many of
those posts had with respect to knowingly misleading webmasters by making false
statements about people you apparently perceive as "competitors", but I see you've
edited your standard post to take of that, so that's great, post all you want.
I may have misunderstood your intent, but to me the part where you made a point to
call me out by my name struck me as you just trying to be a jerk. If I'm wrong about
that I apologize. There's no need to add in extra comments to me that don't tell webmasters
anything and are just said to be rude. In fact it has already cost you at least one
sale that I know of. As you know, I used to speak highly of your software, calling
Phantom Frog the only other good option besides Strongbox. I talked about working
together and mentioned your company to webmasters who called me with some issue
that they hoped Strongbox could solve. When there was a clear legal issue with your
posts, I contacted you privately several times in an attempt to resolve it. In short, I
was very nice to you because I don't see you as competition. I see two companies
working toward the same goal of stopping theives and helping secure web sites.
That's how I'd like things to continue to be, and it makes it hard for me to keep doing
that if you post snide little comments that have nothing to do with helping webmasters,
but are said just to try to pick a fight or be annoying.
As I said, I'd like to continue to say nice things about your product and to mention
you to webmasters for whom Strongbox may not be the best choice or who I frankly
just don't have time to deal with. On the other hand, if you REALLY want to start posting
snide little comments 10 times a day just trying to be a pain in the ass, please think
about how that could turn out. I am familiar with your product. I'm VERY familiar
with geo tracking. I'm familiar with the companies involved, with their license agreements,
and with their registered trademarks. I sincerely hope you can read between the lines
here. If you choose to piss people off just for the fun of it, they may eventually get
tired of it and take five minutes to make a phone call that could create very big
problems for your company, so let's not go there, OK?
Ray,
I think you took my side comment the wrong way. In
a recent post on another board, you made a remark
that I forgot to mention the word "unique". Well, I
found that to be fairly comical and was just returning
the favor. So, "yes, Ray it was worth mentioning"
should be taken in that light (lol).
We've both got better things to be doing than
verbally jousting since there are still webmasters
out there using IP Counting systems. So let's
put this same energy into making a dent there!
Furthermore, we have a common enemy in hackers
who seem to never take a day off or a vacation!
Regards,
George
I have no experience with Phantom Frog, and although George has invited us to try his product, we've honestly felt no need to do so.
I have a fair amount of experence with Pennywise and now with Strongbox. I have no financial incentive or interest in any password protection product, I'm just a technogeek that does my best to learn about and understand issues that relate to my business as best I can in this complex and fast-moving world.
All geoIP information used by any company for any purpose is licensed from one of several companies, and can only be as reliable as the data provided. I've spent a fair amount of time looking into the geoIP issue and underlying technologies to try to gain some understanding of it and how it impacts things like password protection as well as for some other applications we are looking into for future projects.
Honestly, I believe selling geo IP as the end-all for password protection is a case of marketing hype, in much the same way that UltraDNS relies on ignorance about how DNS works to try to sell their service that is unnecessary for most webmasters.
Geo IP tracking is useful for some things, but is far from accurate in many places outside the US as well as many places in the US. It cannot accurately account for things like AOL's proxy-based network, IP anonymizing setups such as TOR and the many other proxy networks, and many similar things, and it is simply wrong a significant portion of the time for a variety of reasons having to do with the way in which existing IP addressing technology works.
While geo IP may be one tool that can potentially be helpful in some circumstances, I think that representing it as a universal panacea in the fight against password sharing, brute force attacks, site ripping, and other forms of content theft is substantially overstating its value, given the inherent shortcomings in the technology as it currently exists. Perhaps that will change if and when IPv6 (a new IP addressing scheme) ever becomes universal, but that appears to be years away.
From talking to Ray about the technology behind Strongbox, and from my own research, I believe that Strongbox has taken into account pretty much all of the potential exploits possible, and addressed ways to prevent them using a more integrated, comprehensive strategy than any other product out there, at least based on what I've been able to find from published information on the major products in the marketplace.
I'm sure that Ray could very easily license geo IP technology and integrate it into Strongbox if he felt it would meaningfully improve the performance of the product, but from my conversations with him on this issue and what I know of the limitations of geo IP technology, I simply don't see that the benefits it would offer are significant enough to warrant its addition to the existing technologies that Strongbox uses to protect membership websites, and the last thing I need is erroneous blocking (either false positive or negative) based on inaccurate geo IP data.
For me, the decision to adopt a techology offered by a given company is in part driven by the technology itself, but in part also how the company markets itself. Of course, every company has to play to its strengths in the marketplace, but when a company is marketing a product against another product without fairly disclosing the limitations of the technology used while at the same time implying it is superior, it simply strikes me as disingenuous, and, for me at least, tends to push me in the direction of using another company's technology.
I'm sure that Phantom Frog and Strongbox (as well as ProxyPass, another major player) all have their individual advantages and disadvantages, and that the webmasters using each product are happy with their choice.
I just wish that companies involved in using marketing hype would instead simply market their products honesty and fairly.
George I apologize then, it seems I took your comment entirely the wrong way.
I had entirely forgotten about the joking comment I posted. Indeed we do have
much more important things to do. I'm half tempted to mention some of the cool new
stuff we're working on, but I know if it was a good idea you guys would likely take
the initiative and run with it, and probably do a pretty good job of it to. :)
George - sometimes our members travel and use their login in different locations - like l.a. and new york. one guys who is a member of our site has accessed our site from several countries as he travels for a living. and i myself have used both earthlink and att to access sites when i review them. also i review for some review sites who have me go in and do the review, then later the owner logs in to take the screencaps.
i guess what i'm saying here is that sometimes allowing only one location per member can keep legitimate members from accessing what they paid for, and other times it can keep your site from being reviewed...
how flexible is your program regarding being able to allow more than one ip per user?
Hi basschick,
Quite to the contrary, Phantom Frog anticipates and factorsQuote:
how flexible is your program regarding being
able to allow more than one ip per user?
in travel by members. So, for example, let's say a trucker
member signed into your site at 10 AM in Boston, signed out
at 10:30 AM. He then drove his truck to NY City for 4 hours
and signed in again at 2:30 PM.
Frog tracks those visits and city locations and allows for
possibility of human travel thereby making those accesses legit.
If however, that second access at 2:30 PM came from LA,
Frog will flag that as abuse since that can't be attributed to
human travel time (unless you're George Jetson!).
Now, in Frog's admin control panel, the webmaster has the
ability to override/adjust settings so that abuse detections
for a particular account can be ignored. This would enable
you to allow more than one IP to be logged in simultaneously
where your circumstance necessitates it. I would direct you
to our sample screenshots which can be viewed here:
http://phantomfrog.com/Life-Cycle-1.html (bottom right corner)
Hopefully, this addresses your question.
In our FREE Trial, the Geo-IP Tracking feature is demonstrated
and abuse reports are generated. You can also look at all
the admin screenshots as well. However, the buttons are
disabled.
We were interested in Strongbox but were told it would not work on our servers so we went with BlackBox instead and have been pretty happy with the results.
i have not used any of them sorry
We use Strongbox on our site. Hot Desert Knights Couldn't be happier.
Yes you do have to type in a code each time, but it's simple, we've never had a complaint and it keeps the bots out.
It's inexpensive and it works. And, it works good.
Bill
Quote:
Originally Posted by GPallan