Quote:
|
Originally Posted by xenigo
I am listening. The password file is in a directory outside the permissions of the web directory. I don't think there's any way that could have been compromised. I believe it was simply a user that posted his password. It looks like that same user has posted the same l/p combo on other password sites.
|
One more time
That is possible
It is also possible someone ran a script that does nothing but try username/password combinations until they cracked an access
There are a few software programs that were built for nothing but hacking accesses to membership sites
When these acesses are compromied they often are posted to password sites
Another good thing that Pennywize does is limited the amount of time an IP can try to enter the site with wrong/random username/password combinations
I'm not taking the users side, I'm telling you it may have not been their fault
Especially if the username/password was something simple like apple/orange