theiving members, major bandwidth!

[xenigo]

Originally Posted by Vick

No, most will take anything for free, please don't feel special because you were leaked

Now it is not necessarily so neophyte
If a script kiddie leaked the password to password trading sites would it be listed just the same?

Please listen when I post, the user may or MAY NOT HAVE leaked the pw
Do you know what a script kiddie is? Do you know how "hacking" software works? Do you know what permissions your password file are set to?

I am listening. The password file is in a directory outside the permissions of the web directory. I don't think there's any way that could have been compromised. I believe it was simply a user that posted his password. It looks like that same user has posted the same l/p combo on other password sites.

[Vick]

Originally Posted by xenigo

I am listening. The password file is in a directory outside the permissions of the web directory. I don't think there's any way that could have been compromised. I believe it was simply a user that posted his password. It looks like that same user has posted the same l/p combo on other password sites.

One more time
That is possible
It is also possible someone ran a script that does nothing but try username/password combinations until they cracked an access
There are a few software programs that were built for nothing but hacking accesses to membership sites

When these acesses are compromied they often are posted to password sites

Another good thing that Pennywize does is limited the amount of time an IP can try to enter the site with wrong/random username/password combinations

I'm not taking the users side, I'm telling you it may have not been their fault
Especially if the username/password was something simple like apple/orange

[Red]

Originally Posted by Vick

One more time
That is possible
It is also possible someone ran a script that does nothing but try username/password combinations until they cracked an access
There are a few software programs that were built for nothing but hacking accesses to membership sites

When these acesses are compromied they often are posted to password sites

Another good thing that Pennywize does is limited the amount of time an IP can try to enter the site with wrong/random username/password combinations

I'm not taking the users side, I'm telling you it may have not been their fault
Especially if the username/password was something simple like apple/orange

You need to listen to Vick. There are a bunch of programs that password crackers use to find passes. Then there are a bunch of other programs to test the viability of those passes. Without protection your site is a cracker's dream. A member usually has no idea that their password has been stolen.
Pennywise is good and reasonable. If you're going to have a paysite, it's a must have investment.

[raymor]

Originally Posted by xenigo

I am listening. The password file is in a directory outside the permissions of the web directory. I don't think there's any way that could have been compromised. I believe it was simply a user that posted his password. It looks like that same user has posted the same l/p combo on other password sites.

Probably 30% of all PHP scripts used by webmasters have a security
hole that will allow an attacker to do exactly that. I see this happen all
the time. (The reason I see it is because I'm the guy webmasters call
for help when it does happen.) You CAN secure your password list
using any of several different methods, most of which involve using stronger encryption such as an MD5 hash. I wrote a page for the Strongbox
manual covering this tooic today, but I left it in the car and I'm on my way to
bed right now, so email me at support@bettercgi.com if you'd like to
loook that over. Strongbox would help you determine if the user himself
leaked the password or if the list was cracked by giving such information
as how many other usernames were compromised at around the same time.
If you have 1,000 members and only this password got posted, and if
this is a also a secure password (long enough, not based on an English word),
he probably gave it out. Onb the other hand, if many different passwords
were posted on the same day the list was probably cracked.
Another possibility is that a cracker got it using a dictionary attack.
If for example his username was "john" and his password was "password"
then the attacker probably guessed it using an automated guessing program
(called a dictionary attack). Definitely chnage the user's password and then
watch what happens with his username in the future.
We'll be standing by to install Strongbox whenever you're ready.