StrongBox is RMEE's user authentication and authorization
system for pay sites and AVS sites. Old style Basic Authentication
no longer acceptable for professional sites because it is
quite vulnerable to password sharing and
brute force attack.
Also, the current versions
of Microsoft™ Media Player do not support these old
fashioned username/password pairs. If you want to stream
video on your web site you must upgrade to StrongBox
without delay. Until you do, customers with newer versions
of Media Player will not be able to access your video content.
Today there are more ways for attackers to share passwords than ever before. Years ago, webmasters only needed to be concerned with password sites. Today, there are old fashioned password sites with links, Yahoo! Groups for sharing passwords, password message boards, sites with sophisticated ActiveX controls to circumvent your protection, and many other methods for password distribution. In todays web environment you need the protection of StrongBox to keep people from stealing your bandwidth by using these passwords. In some cases StrongBox has been able to save webmasters 6 GB per day in bandwidth used by password traders. The average site that doesn't use proper security software like StrongBox seems to be losing about 1 GB per day this way. By eliminating this theft of service, StrongBox will pay for itself the first month you use it.
Brute force
describes an attack in which many
thousands of possible username/password combinations
are attempted very quickly. This type of attack will
often compromise a site protected with basic username /
password pairs. This is particularly true because hackers
use lists that include very predictable user names such
as admin with thousands of likely passwords.
To prevent a brute force attack from succeeding, the
traditional advice has been to choose long, difficult to guess
(and difficult to remember) user names and passwords such
as 8x!O;9&)>Mej9gC<
. Even if all your
subscribers did use such passwords, preventing a compromised
password is not enough. Looking over server
logs, we've seen that failed attacks are fairly common.
Because the attack may or may not compromise any passwords,
the site owner often is none the wiser. But you may notice
a drop in sales or more customer complaints as your
server is significantly overloaded during the course of
an attack. One popular adult web host advised us that
failed brute force attacks regularly
bring servers to their knees
. For that reason,
you need to prevent a brute force attack, along with it's effects
on your server, from ever occurring. If it does occurr,
you need to keep the attacker from using up all of your
server resources in the process. StrongBox provides both
technology to discourage anyone from even attempting such
an attack and a defense against the crippling overload
if they attack anyway. To be precise, strongbox uses a
52 bit session ID. If an attacker were to send your
server 100 requests per second, they could expect to correctly
guess one Strongbox session ID after 1,425,000 years of trying.
StrongBox also allows you to link between sites securely. That is, you can have links in the members section of one domain that can securely bring your members to the members section of another domain, which may be on a different server. You guys with AVS sites know how much of a problem referer spoofing has become, so it's no longer wise to have that kind of setup with just a referer check.
StrongBox is also designed to allow easy integration of a script to protect against "slurping", or bulk downloading of your whole site. While there have always been software programs that would allow a user with even a short term trial membership to download your whole site, this functionality is now built in to major browsers such as IE. In the worst case, after the thief downloads your whole site with the click of a button they will change the referal links and upload the copy to their own server, effectively stealing your business. I can't imagine the uproar there would be if this happened in the offline world - somebody breaking into a store, stealing all of the merchandise, the display racks, signs, etc. and using it all to open an identical store across the street. Yet, many webmasters allow this to happen to them and don't do anything to prevent it. With StrongBox, you can choose from several techniques for detecting the slurping and then ask StrongBox to kick that user out. If they want to look at the rest of your content next month, they'll have to keep their membership current, rather than having a copy on their hard drive. (Be sure to ask about the anti-slurp scripts that interface with StrongBox when you order.)
Among the optional enhancements that you can choose for StrongBox are Reporting and Member Management module and the Deluxe Reporting module. Both provide reports of the most active users over any chosen time period, the most active usernames, etc. You can look up any username to see the exact times, dates, and IPs when they logged in to your site. You can also see what Strongbox determined about the attempted logins. If a username or IP range is suspended or disabled you'll be able to see exactly why. This is also helpful with users who claim to have never your site and ask for a refund. More than one Strongbox webmaster has had a hearty laugh as they emailed a user a complete record of the 22 times the person "used" the site over the last 5 weeks. The users generally apologize and comment on how much they really do like the site. This module also shows any errors that may have occurred, to help in resolving customer complaints. I strongly suggest at least the basic reporting module ($25) for all pay sites. The deluxe report module ($45) adds hit-by-hit reports of exactly which pages, images, and videos a user looked at in any given session.
It's important to me that your site works properly for
your members, and you don't have to struggle with
some script for several hours. Therefore, I always
do the installation for you as a professional courtesy.
The whole point of getting software is to make your job easier,
to make it so you don't have to concern yourself about password
sites or similar problems again. All you need to do is
just email Ray Morris at support@webmastersguide.com.
Strongbox costs $65 for the pay site version, $35 for the AVS site version.
To install it I just need the URL and FTP info. Payment can be made
by ePassporte, PayPal, moneybookers, CC, or just about however you want.
PayPal or moneybookers can be sent to support@webmastersguide.com.
You can email CC info to that same address. For ePassporte, use
raymor@epassporte.com. ePassporte and CC my preferred payment methods.
If you'd like to pay by CC but would rather not email the info,
I can be reached at 979-530-1300 or ICQ at 7208627.
One of these days I'll get a secure payment form back up again.
For those of you with several sites, or who are buying in association
with other webmasters, I offer substantial quanity discounts:
| AVS Sites | Discount | Price each |
|---|---|---|
| 1 site | 0% | $35 each |
| 5 sites | 20% | $28 each |
| 10 sites | 40% | $21 each |
| 20 sites | 60% | $14 each |
| 40 sites | 75% | $8.75 each |
| 70 sites | 80% | $7 each |
| 100+ sites | 85% | $5.25 each |
| Pay Sites | Discount | Price each |
|---|---|---|
| 1 site | 0% | $65 each |
| 5 sites | 20% | $52 each |
| 10 sites | 40% | $39 each |
| 20 sites | 60% | $26 each |
| 40 sites | 75% | $16.25 each |
| 70 sites | 80% | $13.00 each |
| 100+ sites | 85% | $9.75 each |
StrongBox has two requirements as to how
your web server is set up and how your HTML is coded.
We can help get your site ready for StrongBox if needed.
For example, in some cases links within your members
area may need to be adjusted and we can do that with
our search and replace scripts.
To use StrongBox, you must be able to access your site
from ANYTHING.your-site.com (wild card domains). Some hosts
set this up by default. On other hosts I can help get it setup
for you and it's not a big deal. The other thing is that your
members area links can't be full URLs. You have to use this:
a href=./gallery1.htmlor this:
a href=/members/gallery1.htmlinstead of:
a href=http://your-site.com/members/gallery1.htmlIf you have links with full URLs in your members area we can do a search and replace to take care of those for you.
We've tried very hard to make StrongBox as simple as possible and not depend on any more software than necesary. Thus it does not require MySQL or anything else other than Perl, mod_rewrite, and Apache. So far I haven't found any hosts that needed additional software installed. The Perl scripts use the following Perl modules, all of which are standard modules that are probably already installed: