Seriously Bad Password Trading Site - ALERT!

[raymor]

Originally Posted by Hell Puppy

Only person I ever know of who actually went after a pw trader was Brad Shaw. Kudos to him for standing up to it, but I'm pretty sure in the end it cost a ton of money, time and hassle and did nothing to fix the problem.

As long as the industry is willing to cannibalize itself, there will always be asshats.

Absolutely. I kind of laugh when I see someone post "here's a password site" because I'm
thinking "yeah, and we have tens of thousands of others in our database - what's your point?"
People say "go check to see if your site is listed here". What, and then check the other 50,000?
Of course we DO check all 50,000, but we do that with a script, not by posting and manually
checking one at a time.

I totally agree going after individual password sites will never fix the problem. Putting pressure
on sponsors to not support password sites helps keep them from getting totally out of control,
only because sponsors know they risk losing a lot of business if they support ANY password
site, not one specific site.

Other than that, I think the way to go is first to have a good defense, like Strongbox, so that the
password sites don't have YOUR passwords, and encourage other sites to protect themselves
so that the password sites have fewer passwords to any good sites. Then, on offense, we take
a more clandestine "special ops" kind of approach. Just like legit webmasters need each other
in order to flourish, and talk amongst themselves, the bad guys have their own forums and their
own important business relationships. Infiltrating and disrupting the network is where it's at
offensively, I think. We try to cause the password sites to fight amongst themselves to to not
trust each other. We feed the hackers false technical information and keep an eye on what they
know and what types of attacks they are wanting to try.

The problem with the clandestine work is that it doesn't make any sense for any one webmaster
to put in the time it takes to be trusted by the important bad guys. That's best done by a third
party, working on the behalf of the webmaster community as a whole. But since it's clandestine
no one in the webmaster community knows what's being done and since the work benefits all
adult webmasters together no specific webmaster is going to pay us for this kind of work. If you
do want to support this kind of work, I suppose what you can do is buy your defensive systems
from the company which is taking the lead in fighting the password thieves and the rippers.