Pay-Site Password Protection

[GPallan]

Is Strongbox the best (and only?) answer?

I’m with CCBill and they don’t provide any password protection per se. So what should I be using to prevent multiple people using the same password? Or any other protection I may need against password and content theft that I don’t know about (and would rather avoid than to find out the hard way)?

Thanks a lot guys!

Allan

[alexbucks]

It is very expensive. No, it is not the only and/or best answer. Do you know Password Sentry?

[basschick]

i hear good things about proxypass from people who use it - very good things, actually. and there's also pennywize. strongbox is a good solution, too, and an inexpensive one-time charge while the other two i mention here are recurring.

[Lee]

an inexpensive one-time charge while the other two i mention here are recurring.

The one-time charge was actually the deciding factor for me in getting StrongBox over PennyWize although, even that right now is becoming to much to spend with every site i launch so im actually looking at getting a custom solution created that ill only have to pay for once and use an unlimited amount of times.

Regards,

Lee

[GPallan]

But doesn't Strongbox have that really annoying feature where you have to enter the "code" in the box every time you enter the member's area? like what you see on this site http://www.shanesixty.com/memberslounge/

or is there a way not to have that feature?

can you guys point me to some other sites that also use Strongbox? Just want to see what the setup looks like.

thanks

allan

[Lee]

Allan,

That 'annoying feature' is actually what stops password traders etc.

You can customize the look of that page though (which is something i havent actually got around to doing yet )

Regards,

Lee

[Chilihost]

strongbox is the best, toomuchmedia also has a product out but i haven't heard of anyone using it yet.

alexbucks, I don't think a one-time fee of $150 is expensive at all????? Its cheaper than most good quality CMS systems or other adult-targeted scripts.

Allan, as for the code, you can disable that but its not recommended, as Lee says, its part of the reason its security is better than most others.

[gaybucks_chip]

We used to use Pennywize, then switched to Strongbox.

No comparison.

Strongbox is very robust and protects content in a number of different ways, not just by preventing password sharing. It is very sophisticated in the algorithms it uses to temporarily disable, and then, if abuse persists, permanently disable passwords.

The CAPTCHA code can be disabled if not wanted, but frankly, we've had no complaints from users about it.

We've had several programmers say they could replicate Strongbox's security "easily" but when they actually look at everything it does, suddenly they aren't nearly so confident. Honestly, for $150 or whatever it costs, it's pretty cheap insurance against bandwidth theft and shared passwords.

I highly recommend it.

[raymor]

You actually have several options with the Turing Image feature.
You can even turn it totally off if you want to, but you have a
range of options where you can use the extra security without
annoying your customers, so you'll probably use it in some form
after considering all of your options.

As you can see on the site you mentioned, shanesixty.com, the
Strongbox images are not the annoying ones like on Yahoo.com
that are very hard to type correctly the first time. Instead, Strongbox
always uses a simple English word, displayed in pretty clear letters.
The words aren't quite clear enough to be read reliably by OCR software,
but are easy to read even at 3:00 AM when your eyes are tired.
I've been closely tracking OCR software development for 15 years
what what I found out is that there just really hasn't been that much
development. OCR wasn't very good 15 years ago, it's not very good
now, and there is no reason to believe it will be very good in five years,
so there's no need for the annoying, hard to read images with 10 random
characters. Over the years we've heard only one user complain about
the Turing Image, a partially blind person. We took care of him, of course,
but more on that later. For those who want a little bit more security against OCR,
which we don't see hackers using anyway, we have a couple new types of
images you can choose along with the default you see on shanesixty.

Default:


Tie dye:


Segmented:




As I mentioned you can also turn them off entirely if you think users will
have trouble typing a word, but you can also avoid any trouble for your
users AND scare off potential attackers with "bluff mode". Using "bluff mode",
potential attackers see the Turing image and leave to go attack an easier
target who doesn't have this protection, not knowing that the word doesn't a
ctually have to be entered correctly - it's just a bluff.

Oh and of course for our vision impaired porn afficionados:
Another option

I think you'll find that there are a lot of guys who started playing around with PHP a
couple of years and ago and figured they'd start selling a simple IP counting script
along with the other scripts they sell, but you won't find anyone else who has put the
kind of thought and research into protecting your site that the Strongbox developers
have for the last ten years. We don't sell an affiliate program script, a submission
script, or a shopping cart script. We spend 40 hours a week, every week for years,
finding the very best ways to protect your site. From our role in the development of
the initial .htaccess that has been used to protect almost every AVS site since we
published the code on our site in 1997 up until the upcoming release of Strongbox 4.0
with biometric indicators, we do one thing - research the best ways to protect your site.
That's what we do, what we've done for years, and what we do well.

You can play with some cute little IP counter if you have a little hobby site that you
enjoy working on, and in fact I would encourage you to do so, to get a feel for what
the business was like back in the late 1990's. If you build a professional site that
you intend to make a living from, I would strongly suggest carefully considering
professional tools and systems. Not just security - that means regular backups so
you don't lose your business due to a hard drive failure or hacker, a truly
professional web host like Chilihost to keep your servers fast and reliable, and
reliable payment processing. At that level you also may want to consider what
happens when your site gets listed on the big password sites and you get a
bandwidth bill for $650 for the first night, while at the same time your customers
can't use the site because of the load. At some point, when your site is truly a
professional site providing you with real income, you'll want to use a professional
security system to protect it.

[raymor]

Or any other protection I may need against password and content theft that I don’t know about (and would rather avoid than to find out the hard way)?

I forgot to reply to this part, asking about other types of protection.
When using CCBill or most other major processors, your passwords are
"encrypted" using an extremely old and weak type of encryption that can
be cracked in seconds. While it doesn't happen as frequently as brute force
attacks and password sharing, when a cracker downloads your whole password
file and posts ALL of your passwords on passwords sites it's a huge pain in
the ass. You have to issue a new password to each and every user. One
of the best ways to prevent that is to upgrade your CCBill script to use
strong encryption. It's a simple upgrade we can do for you for $20.

As far as content theft, put your URL on your content so when/if it's stolen it becomes
free advertising. Images can't really be protected from theft and redistribution on an
internet site. On an INTRAnet site it's possible using some software we wrote for a
major research university many years ago, but it can't be done in a platform independent
manner. Videos can be protected to some extent with DRM, but I don't suggest it.
DRM is not platform independent, it's Windows only. I don't think it's worth giving
up the 10% of your customers who wouldn't be able to play your videos. It also
offers essentially NO protection at all since it can be cracked by any eight year old
using a point and click program like http://www.dvd-tool.com/drm-removal.html .
Both Microsoft's DRM and Apple's were cracked very quickly, I believe one of them
was cracked before it was even officially released, so that tells you how effective that
approach is. Besides that fact that with DRM you have to pay money out of your pocket
every time someone watches one of your videos. If I were running a site I'd prefer to
keep the 10% or so of customers who can't watch DRM "protected" video conveniently
and just put my URL on the videos, then HOPE they get out on the peer to peer
networks to provide free advertising.

All that said, there are certainly some intelligent people who use DRM, and they
may have good reasons for doing so in their own business if they have extremely
unique content or somethign like that. Generally for a porn site, though, I'd say
just put your URL on there and spend the time thinking about marketing rather than
content theft.

After all that I actually have still more to say about the subject, if you can believe that.
In my opinion, while it's good to have some of your images and videos floating around
with your URL on them, ideally you would NOT have someone go in and just download
huge sections of your site and post it somewhere, a practice called "ripping".
Strongbox provides two features that provide some protection against such ripping.
(On the Strongbox site you'll see it called "slurping", the term we used before
"ripping" was invented".) For further protection against ripping you can use our
only other product, Throttlebox, which is designed just for that purpose. If your
site is fairly small at this time the protections built into Strongbox are probably enough,
though.

[GPallan]

I forgot to reply to this part, asking about other types of protection.

wow...you've answered every questions that i had (and also the ones that i didn't know i had) regarding Strongbox. THANKS!!

I’m buying my copy right now

[raymor]

wow...you've answered every questions that i had (and also the ones that i didn't know i had) regarding Strongbox. THANKS!!

I’m buying my copy right now

I'm glad I could be of help. I'll be looking for that order form.
Just let us know if we can be of any further assistance.

[GPallan]

I'm glad I could be of help. I'll be looking for that order form.
Just let us know if we can be of any further assistance.

Raymor...i purchased a copy for my site www.dixter.com. But it's saying that it's going to take three days to set it up. I'm experiencing some password hacking/sharing as i'm writing this! Is there anyway so set it up right away? Please let me know would really appreciate it. Thanks

Allan

[gmr324]

Allan,

I represent a password protection system called
Phantom Frog that is setting a new standard for
password security. Our product uses Geo-IP tracking
technology which will not even allow 2 people to
share the same password let alone a whole trading
forum with hundreds of leechers!

Our High-Resolution Geo-IP Tracking offers the most
accurate password abuse detection available anywhere.
It tracks all visits to the members area of a site
down to the city level. Furthermore, it takes
latitudal and longitudal data into consideration.
Therefore, Frog detects the fact that the same
password was used in L.A. and NYC. We pinpoint the
abuse instantly, allowing for the possibility of
legitimate travel. That level of resolution is unique
to Phantom Frog (yes Ray, it was worth mentioning).

Our system is based upon the premise of providing
24/7 uninterrupted access to the legitimate members
while blocking out the leechers. This is accomplished
automatically through our unique Automated Member
Support (AMS) feature. AMS re-issues a new password
directly to the affected members. This strategy breaks
the cycle of password abuse and frees up the webmasters
to do more important work.

Please check out one of our latest press releases at:
http://forums.gaywidewebmasters.com/...334#post190334

Our product is integrated with CCBill, NetBilling,
Paycom, NATS, MPA3, Verotel, 2000Charge, SegPay, Jettis,
and 365Billing. Phantom Frog has a simple FREE Trial
Version which installs by adding one html tag or we
can handle the installation completely for you for.
In fact, we recommend that you leave ProxyPass or
Pennywize activated during our Trial to witness
first-hand all the abuse being missed by them!

Most of customers were motivated to purchase our
password protection only 3 days after installing the
Free Trial! We also offer Automated Member Support,
Brute Force Attack Protection, and Bandwidth Abuse
Protection.

Phantom Frog has stellar webmaster testimonials which
are listed on our site. A high percentage of our clients
are ex-ProxyPass/Pennywize clients. A casual scan of
our webmaster testimonials page will reveal how unaware
they were of the password abuse which was being allowed
and overlooked by their current protection system.


Please feel free to contact me with any questions or feedback.

Visit out site to learn more: http://www.PhantomFrog.com/g

Visit this link to try our FREE demo: http://phantomfrog.com/g?ft=1
Thanks

George

Email: George@PhantomFrog.com
ICQ: 226948212

[GPallan]

Thanks, George. I'm going to give your free trial a try. Thanks for the quick solution

Allan