Big LOL! Info sent to me by Strongbox - GoFuckYourself.com

czarina · 01-16-2012, 02:18 PM

I recently installed Strongbox/Throttlebox in my main sites, and today talking to their techs, they sent me this info. I thought it was very cute (and enlightening), so read on:

Typical usernames and passwords are normally 9 characters long. That means there are this many possible user names: 84,590,643,846,578,176
There are also this many possible passwords: 84,590,643,846,578,176

To successfully hack the site by brute force, the hacker has to guess a valid combination of username and password. To get the number of possible combinations he would have to try, we multiply the number of usernames he has to try by the number of passwords for each one:

7,155,577,026,378,634,231,908,944,079,486,976
pairs he has to try

At the maximum possible rate of guessing that Strongbox would allow even for a hacker using a BILLION proxies, how long would it take for them to get just one correct username/password combination? Here's how long it would take, on
average:
41,409,589,273,024,503,656,880,463 days

How long is 41,409,589,273,024,503,656,880,463
days? It's 113,450,929,515,135,626,457,207 years.

The dinosaurs roamed the earth only 65,000,000 years ago. So if tyrannosaurus rex started an attack on your site, which is protected by Strongbox, 65,000,000 years later he still would not have guessed a working user/pass.

To be more precise, there is a
99.99999999999999999% chance that he would not have gotten in after 65 million years.

Let's look at it another way:

Since dinosaurs:
65,000,000 years

Age of the earth:
4,500,000,000 years

Age of the universe:
13,700,000,000 years

Brute force Strongbox:
113,450,929,515,135,626,457,207 years

So if God had started trying to brute force your site at the same time that he created the universe, His progress bar on his brute force software still wouldn't have hit 1%.

You bought Strongbox to protect you from brute force.
It's doing that, very well. Relax and let it do its job. Strongbox may be notifying you that it is blocking a lot of IP addresses. As the emails say, those IPs are blocked. Unless the attacker lives much longer than the universe, Strongbox will keep blocking every one he tries.

YEP, I recommend Strongbox!

papill0n · 01-16-2012, 02:34 PM

when god created the universe

Cystomatic · 01-16-2012, 02:38 PM

Hhaha, very nice from them for informing you with this.

Going to check them out now.

Why · 01-16-2012, 02:49 PM

the logic used above is flawed, because crackers know what words and strings are used most frequently. so that shortens the list down tremendously. secondly, just because the average is 9 does not mean you can not crack using every combination of 6 or shorter, where 6 is the usual minimum user/pass length at many sites.

not to say strongbox isnt a good solution, but their math is a bit off IMO.

iSpyCams · 01-16-2012, 03:15 PM

They will hack your email (since the user is known) and retrieve the password.

Or else buy a database of user and pass combos from another site and see if there are any repeats, so many people use the same combo for everything.

ladida · 01-16-2012, 03:20 PM

Quote:

Originally Posted by czarina

I recently installed Strongbox/Throttlebox in my main sites, and today talking to their techs, they sent me this info. I thought it was very cute (and enlightening), so read on:

Typical usernames and passwords are normally 9 characters long. That means there are this many possible user names: 84,590,643,846,578,176
There are also this many possible passwords: 84,590,643,846,578,176

To successfully hack the site by brute force, the hacker has to guess a valid combination of username and password. To get the number of possible combinations he would have to try, we multiply the number of usernames he has to try by the number of passwords for each one:

7,155,577,026,378,634,231,908,944,079,486,976
pairs he has to try

At the maximum possible rate of guessing that Strongbox would allow even for a hacker using a BILLION proxies, how long would it take for them to get just one correct username/password combination? Here's how long it would take, on
average:
41,409,589,273,024,503,656,880,463 days

How long is 41,409,589,273,024,503,656,880,463
days? It's 113,450,929,515,135,626,457,207 years.

The dinosaurs roamed the earth only 65,000,000 years ago. So if tyrannosaurus rex started an attack on your site, which is protected by Strongbox, 65,000,000 years later he still would not have guessed a working user/pass.

To be more precise, there is a
99.99999999999999999% chance that he would not have gotten in after 65 million years.

Let's look at it another way:

Since dinosaurs:
65,000,000 years

Age of the earth:
4,500,000,000 years

Age of the universe:
13,700,000,000 years

Brute force Strongbox:
113,450,929,515,135,626,457,207 years

So if God had started trying to brute force your site at the same time that he created the universe, His progress bar on his brute force software still wouldn't have hit 1%.

You bought Strongbox to protect you from brute force.
It's doing that, very well. Relax and let it do its job. Strongbox may be notifying you that it is blocking a lot of IP addresses. As the emails say, those IPs are blocked. Unless the attacker lives much longer than the universe, Strongbox will keep blocking every one he tries.

YEP, I recommend Strongbox!

If that was all true, it would be good, however, it's not, it's why so many sites get hacked anyway. Ray likes to exaggerate a lot to sell a product, it's fine in a way i guess.

ruff · 01-16-2012, 03:21 PM

7,155,577,026,378,634,231,908,944,079,486,976 pairs he has to try. I guess that's only if he finally gets to the last pair. What happens if he gets them on try number 4?
People win the lottery you know. I don't, but I read about them all the time.

CyberHustler · 01-16-2012, 03:22 PM

L-Pink · 01-16-2012, 03:26 PM

My pet's name is on a sticky attached to the side of my monitor.

.

MaDalton · 01-16-2012, 03:35 PM

we use 16 character random usernames and passwords - that should take a while to guess

Brujah · 01-16-2012, 03:36 PM

You definitely don't want God hacking your site.

georgeyw · 01-16-2012, 03:41 PM

Quote:

Originally Posted by Why

the logic used above is flawed, because crackers know what words and strings are used most frequently. so that shortens the list down tremendously. secondly, just because the average is 9 does not mean you can not crack using every combination of 6 or shorter, where 6 is the usual minimum user/pass length at many sites.

not to say strongbox isnt a good solution, but their math is a bit off IMO.

Also the fact that t-rex could have guessed the correct combo on his second attempt...

Half man, Half Amazing · 01-16-2012, 03:49 PM

....but I'm pretty sure the Republican party has facts to prove the earth is only 6000 years old.

2MuchMark · 01-16-2012, 04:22 PM

Interesting post, but it sounds more like a sales pitch. Using Brute force to crack a 9 character username + 9 character password is inefficient, and a very simple - too simple actually - way to code a hack program.

A much smarter way to do it would be to first assess the users if possible to determine where most are from (say, North America). Most people use real words, real names, pet names, etc. A smarter hack would be to use the commonly used words from the North American dictionary, or most commonly used names (and pet names). Most people add "69" to the end of the name where numbers + letters are required, so a smarter program would have to take that into consideration.

With a little bit of smart coding, it would take much less time to gain access to a server then the way it is described in your post.

ottopottomouse · 01-16-2012, 04:22 PM

so...

every time you double your number of members, your security is halved.

people never guess the right password until they have tried every other possible combination.

dinosaurs with short arms that would find it physically impossible to have a wank still love porn.

uno · 01-16-2012, 04:34 PM

Quote:

Originally Posted by pompousjohn

They will hack your email (since the user is known) and retrieve the password.

Or else buy a database of user and pass combos from another site and see if there are any repeats, so many people use the same combo for everything.

There are millions of username and password combinations out there from hacked passfiles and whatnot. It's not hard to get a hold of them and find several hundred working logins if you have enough proxies and the right tools.

edgeprod · 01-16-2012, 04:38 PM

So if I can give you lists of Strongbox protected sites user/pass combinations, what do I win? Does that make me more powerful than God? Cool!

mikesouth · 01-16-2012, 04:41 PM

your site can be brute force hacked in a matter of an hour or so usually without fail. I wont expose the methodology they use but they truth is they arent randomly guessing passwords and logins, they use combos that are known to be valid. Im not saying strongbox isnt good...its the best...I use it and I strongly recommend it. But dont think for even a second that these brute force attacks are random guesses...they arent

raymor · 01-16-2012, 05:02 PM

Quote:

Originally Posted by ruff

7,155,577,026,378,634,231,908,944,079,486,976 pairs he has to try. I guess that's only if he finally gets to the last pair. What happens if he gets them on try number 4?
People win the lottery you know. I don't, but I read about them all the time.

That's why I said "on average". There's an infinitesimal chance (roughly one in 577,026,378,634,231,908,944,070) of getting one right on the first guess. There's an equal chance of guessing any particular combo last. "On average" are important words if you're going to get into the math.

Of course, even if I had forgotten those words amd I was off by a factor of a million, that doesn't change the fact that the attacker will die long before succeeding.

raymor · 01-16-2012, 05:05 PM

Quote:

Originally Posted by Why

the logic used above is flawed, because crackers know what words and strings are used most frequently. so that shortens the list down tremendously. secondly, just because the average is 9 does not mean you can not crack using every combination of 6 or shorter, where 6 is the usual minimum user/pass length at many sites.

not to say strongbox isnt a good solution, but their math is a bit off IMO.

We also know what's used frequently and we know that six character passwords aren't good. You've made the assumption that we're stupid and we set her site up stupidly. We are not stupid, so we don't assign "password" as a password.

raymor · 01-16-2012, 05:09 PM

Quote:

Originally Posted by **********

Interesting post, but it sounds more like a sales pitch. Using Brute force to crack a 9 character username + 9 character password is inefficient, and a very simple - too simple actually - way to code a hack program.

A much smarter way to do it would be to first assess the users if possible to determine where most are from (say, North America). Most people use real words, real names, pet names, etc. A smarter hack would be to use the commonly used words from the North American dictionary, or most commonly used names (and pet names). Most people add "69" to the end of the name where numbers + letters are required, so a smarter program would have to take that into consideration.

With a little bit of smart coding, it would take much less time to gain access to a server then the way it is described in your post.

If we let people choose stupid passwords, they would do so, yes. Why assume that we're stupid and do that? Anyway, that was sent in regards to a query about brute force specifically. Yes, other hacks exist, especially if you run Plesk, so visitors are permitted to upload their own scripts. That's not the topic of the email.

raymor · 01-16-2012, 05:14 PM

Quote:

Originally Posted by edgeprod

So if I can give you lists of Strongbox protected sites user/pass combinations, what do I win? Does that make me more powerful than God? Cool!

$10,000 was the offer for hacking Strongbox.

Strongbox is very flexible and will allow for many configurations and compatibility with a lot of different third party software, some better than others. The $10,000 challenge was for any site using our recommended configuration.

raymor · 01-16-2012, 05:17 PM

Quote:

Originally Posted by ladida

If that was all true, it would be good, however, it's not, it's why so many sites get hacked anyway. Ray likes to exaggerate a lot to sell a product, it's fine in a way i guess.

If you're going to call me a liar, would you like to be a little more specific? I would appreciate it if you would either be specific about what you say I'm lying about, or apologize.

ladida · 01-16-2012, 05:41 PM

Quote:

Originally Posted by raymor

If you're going to call me a liar, would you like to be a little more specific? I would appreciate it if you would either be specific about what you say I'm lying about, or apologize.

I did not say you lied, you just manipulated statistics and ignorance to have a sales pitch, which is fine i guess. What i meant has already been said in this thread. No one in their right mind takes a random bruteforce and goes from aaaaaaaaa to zzzzzzzzz. If you are saying they do, then your security courses are from, i dunno, 1980?

Quote:

Originally Posted by raymor

The $10,000 challenge was for any site using our recommended configuration.

That challenge was also bogus. Your descriptions make it so you won't pay anyone anything, you just have that challenge. Similar to how vivid offers multi milion dollar contracts to celebs that mostly don't go through and are a sales pitch.
Just for laughs, what are the sites that use "strongbox recommended configuration" ?

Relentless · 01-16-2012, 06:02 PM

It's a very good sales pitch, and an even better product.
What matters much more than the math is the fact that the owner of the product actually cares about whether or not his clients are protected.
That means if anyone did ever successfully attack the software, it would evolve and prevent future attacks.
With software you can not ever account for the unknown... You can update to overcome anything that eventually becomes known.
Clearly Stronbox does a good job with that.

I do not make a penny from strongbox. I have never met Raymor.
Ask around and read his posts. That tells you all you need to know.

ruff · 01-16-2012, 06:18 PM

Quote:

Originally Posted by raymor

That's why I said "on average". There's an infinitesimal chance (roughly one in 577,026,378,634,231,908,944,070) of getting one right on the first guess. There's an equal chance of guessing any particular combo last. "On average" are important words if you're going to get into the math.

Of course, even if I had forgotten those words amd I was off by a factor of a million, that doesn't change the fact that the attacker will die long before succeeding.

There is no doubt that you are correct and it would be virtually impossible to hack a user combo through Strongbox which I know to be a superior product having used it before. But this is GFY and there is a measure of shit we are almost obligated to give anyone who posts Star Trek figures. If I were to sit down and try to hack a Strongbox site, I would give up after, say, 10 tries. That's because I understand 10, but cannot get a handle on 577,026,378,634,231,908,944,070. Anyway, I value my time conservatively at $60 an hour so it would be more efficient just to buy a membership. Hey, was that your plan all along?

raymor · 01-16-2012, 06:53 PM

Quote:

Originally Posted by ladida

I did not say you lied, you just manipulated statistics and ignorance to have a sales pitch, which is fine i guess. What i meant has already been said in this thread. No one in their right mind takes a random bruteforce and goes from aaaaaaaaa to zzzzzzzzz. If you are saying they do, then your security courses are from, i dunno, 1980?

Nope, not a sales pitch. See the first sentence in the thread. That's from an email sent to an existing customer who asked whether they should be concerned about brute force.

Take any one security class from any decade, then let's discuss it. You are correct that brute force certainly is not the preferred method if you have a choice. The OP posted my explanation of WHY it's not the preferred method. In fact, though, brute force is used all the time when you don't have a better option. I've personally used it more than once successfully. Some members of this board would have lost their servers if I hadn't brute forced a particular security system.

Quote:

That challenge was also bogus. Your descriptions make it so you won't pay anyone anything, you just have that challenge. Similar to how vivid offers multi milion dollar contracts to celebs that mostly don't go through and are a sales pitch.

Do your homework, then see if you still think so.
Clearly you haven't read the posts where the challenge was posted. GFY is funny that way. You didn't even know there WAS a challenge until I just told you, yet magically you know it's bogus. We're not allowed to post links to other forums, but use "search" on some of the security and hacker forums for details. Just FYI, someone did have a partial win by showing that ONE layer of our security wasn't as strong as intended. We fixed that up and rewarded them in the way they requested. Please do your homework before calling me bogus etc. There's a reason I'm the only licensed security professional doing adult.

raymor · 01-16-2012, 07:06 PM

Quote:

Originally Posted by ottopottomouse

so...

every time you double your number of members, your security is halved.

Basically true for brute force. If you use the default 1970s encryption that the processors provide, it's actually a lot worse due to collisions. You can get into all kinds of funky math there, but yeah basically the more members you have, the more "correct" combinations there are, so it's easier to guess one. See the birthday paradox too.

Quote:

people never guess the right password until they have tried every other possible combination.

Any permutation would be tried at m / 2 on average.

Quote:

dinosaurs with short arms that would find it physically impossible to have a wank still love porn.

They like poo.

ladida · 01-16-2012, 07:37 PM

Quote:

Originally Posted by raymor

Do your homework, then see if you still think so.
Clearly you haven't read the posts where the challenge was posted. GFY is funny that way. You didn't even know there WAS a challenge until I just told you, yet magically you know it's bogus.

I know of the "challenge" and i even think i called you out on that stupid challenge here, i'm not sure anymore it was a long time a go. Way to fail that you just told me about it

Quote:

We're not allowed to post links to other forums, but use "search" on some of the security and hacker forums for details. Just FYI, someone did have a partial win by showing that ONE layer of our security wasn't as strong as intended. We fixed that up and rewarded them in the way they requested. Please do your homework before calling me bogus etc.

I did do it.
I know who "partially won" your challenge, i also know he's not the only one, you're just not aware of it since you live in your little fantasy. He was just the only one that contacted you obviously.

You failed to mention the sites that follow "strongbox recommended settings". Name 2-3 different companies, i'm curious.

Operator · 01-16-2012, 09:57 PM

Raymor ain't dumb

AllAboutCams · 01-16-2012, 10:09 PM

i guess i should start know

2intense · 01-17-2012, 12:34 AM

Operator · 01-17-2012, 02:02 AM

The wrong strong box ha

czarina · 01-17-2012, 07:09 AM

Actually, we have received over 11,000 attempts since yesterday afternoon on one of our sites. They're still trying, but haven't gotten in. So yes, strongbox is doing its job

seeandsee · 01-17-2012, 07:21 AM

i guess people then should use strong user,pass combo as MUST

small,big letters and numbers and min 10 chars for user,pass
and you are safe

iSpyCams · 01-17-2012, 07:40 AM

Quote:

Originally Posted by czarina

Actually, we have received over 11,000 attempts since yesterday afternoon on one of our sites. They're still trying, but haven't gotten in. So yes, strongbox is doing its job

I wonder how many are valid users who can't access a site they paid for?

czarina · 01-17-2012, 08:03 AM

Quote:

Originally Posted by pompousjohn

I wonder how many are valid users who can't access a site they paid for?

none. We've been going through the reports. We do our best to make our members happy

raymor · 01-17-2012, 08:33 AM

Quote:

Originally Posted by seeandsee

i guess people then should use strong user,pass combo as MUST

small,big letters and numbers and min 10 chars for user,pass
and you are safe

Most importantly, long passwords. Think "pass phrase". One extra character adds a lot more entropy than including a few odd punctuation marks in the set.

Only if the site is NOT using the default 1970s encryption that the processors use by default, though. The default scripts from the processors ignore everything but the first eight characters.

PornDiscounts-R · 01-17-2012, 08:50 AM

Quote:

Originally Posted by Relentless

It's a very good sales pitch, and an even better product.
What matters much more than the math is the fact that the owner of the product actually cares about whether or not his clients are protected.
That means if anyone did ever successfully attack the software, it would evolve and prevent future attacks.
With software you can not ever account for the unknown... You can update to overcome anything that eventually becomes known.
Clearly Stronbox does a good job with that.

I do not make a penny from strongbox. I have never met Raymor.
Ask around and read his posts. That tells you all you need to know.

So very true

ArsewithClass · 01-17-2012, 08:51 AM

Quote:

Originally Posted by czarina

YEP, I recommend Strongbox!

Saved me loads of time with brute attacks.. Best pennies I ever spent

tony286 · 01-17-2012, 09:05 AM

Raymor makes a quality product.
I read this about pass phrases and have been using them instead of passwords for sites I go to.
http://www.codinghorror.com/blog/200...s-phrases.html

lucas131 · 01-17-2012, 09:11 AM

hacking one combo on strongbox take maybe unlimited time, but hack complete database with everything that is stored take few hours or few days maximum. oh poor dinosaur he cant hack strongbox

lucas131 · 01-17-2012, 09:15 AM

oh and the best is, that threads like this about security are on gfy not new, but there is still most of webmasters who smile but use password under 8 chars. i know what i am talking about, go pimps!

TheDA · 01-17-2012, 09:46 AM

Quote:

Originally Posted by edgeprod

So if I can give you lists of Strongbox protected sites user/pass combinations, what do I win? Does that make me more powerful than God? Cool!

Nothing because anyone can get them from the good surfer forums

V_RocKs · 01-17-2012, 10:22 AM

That is all good... But if you allow your surfer to make their own username/password combo that all goes out the window.

If you do... and you own Met-Art then I hack into X-Art with server level access and steal their combos... Now I have a list of tens of thousands of people that enjoy nude art sites and have all join the majority of them at one time or another.

So by the time I run 50 combos on your site I am in 2 or 10 times or so...

michael.kickass · 01-17-2012, 12:28 PM

schiz · 01-17-2012, 12:32 PM

I've always had good experiences with StrongBox. With the right settings, you're golden.

Alex_ · 01-20-2012, 05:11 AM

raymor

Are you going to respond to my emails?

Avalana · 01-20-2012, 05:19 AM

Anway, interesting read

just a punk · 01-20-2012, 05:53 AM

Quote:

Originally Posted by czarina

Since dinosaurs:
65,000,000 years

Age of the earth:
4,500,000,000 years

Age of the universe:
13,700,000,000 years

Brute force Strongbox:
113,450,929,515,135,626,457,207 years

The mass of our Universe is 6*10^52 kilograms.

01-16-2012, 02:18 PM	#1
czarina Webmaster Extraordinaire Industry Role: Join Date: Jul 2002 Location: A beautiful beach... Posts: 10,745	Big LOL! Info sent to me by Strongbox I recently installed Strongbox/Throttlebox in my main sites, and today talking to their techs, they sent me this info. I thought it was very cute (and enlightening), so read on: Typical usernames and passwords are normally 9 characters long. That means there are this many possible user names: 84,590,643,846,578,176 There are also this many possible passwords: 84,590,643,846,578,176 To successfully hack the site by brute force, the hacker has to guess a valid combination of username and password. To get the number of possible combinations he would have to try, we multiply the number of usernames he has to try by the number of passwords for each one: 7,155,577,026,378,634,231,908,944,079,486,976 pairs he has to try At the maximum possible rate of guessing that Strongbox would allow even for a hacker using a BILLION proxies, how long would it take for them to get just one correct username/password combination? Here's how long it would take, on average: 41,409,589,273,024,503,656,880,463 days How long is 41,409,589,273,024,503,656,880,463 days? It's 113,450,929,515,135,626,457,207 years. The dinosaurs roamed the earth only 65,000,000 years ago. So if tyrannosaurus rex started an attack on your site, which is protected by Strongbox, 65,000,000 years later he still would not have guessed a working user/pass. To be more precise, there is a 99.99999999999999999% chance that he would not have gotten in after 65 million years. Let's look at it another way: Since dinosaurs: 65,000,000 years Age of the earth: 4,500,000,000 years Age of the universe: 13,700,000,000 years Brute force Strongbox: 113,450,929,515,135,626,457,207 years So if God had started trying to brute force your site at the same time that he created the universe, His progress bar on his brute force software still wouldn't have hit 1%. You bought Strongbox to protect you from brute force. It's doing that, very well. Relax and let it do its job. Strongbox may be notifying you that it is blocking a lot of IP addresses. As the emails say, those IPs are blocked. Unless the attacker lives much longer than the universe, Strongbox will keep blocking every one he tries. YEP, I recommend Strongbox!

01-16-2012, 03:21 PM	#7
ruff I have a plan B Industry Role: Join Date: Aug 2004 Location: Seattle - Miami - St Kitts Posts: 5,501	7,155,577,026,378,634,231,908,944,079,486,976 pairs he has to try. I guess that's only if he finally gets to the last pair. What happens if he gets them on try number 4? People win the lottery you know. I don't, but I read about them all the time. __________________ CryptoFeeds

01-16-2012, 03:35 PM	#10
MaDalton I am Amazing Content! Industry Role: Join Date: Feb 2004 Posts: 39,822	we use 16 character random usernames and passwords - that should take a while to guess __________________ AmazingContent.com - providing only the best content and service since 2003 Monetize your content on Veegaz.com - one of Germanies largest VOD sites Got German traffic? We convert it into money for you! Skype: madalton02826 - Email: oltecconsult [at] gmail [dot] com

01-16-2012, 03:36 PM	#11
Brujah Beer Money Baron Industry Role: Join Date: Jan 2001 Location: brujah / gmail Posts: 22,157	You definitely don't want God hacking your site. __________________ Free Premium Domain Lists and Tools at Clickmojo.com For Sale: Obscenity.com

01-16-2012, 03:49 PM	#13
Half man, Half Amazing Confirmed User Join Date: Feb 2008 Location: Capital Wasteland, DC Posts: 372	....but I'm pretty sure the Republican party has facts to prove the earth is only 6000 years old. __________________ Is this gonna get ugly, now? Huh? I hope not. Because I thought what we were here, racial differences notwithstanding, was just a couple of old friends. You know, just both of us Californians.

01-16-2012, 02:34 PM	#2
papill0n Unregistered Abuser Industry Role: Join Date: Oct 2007 Posts: 15,547	when god created the universe

01-16-2012, 02:38 PM	#3
Cystomatic Confirmed User Industry Role: Join Date: Dec 2011 Posts: 361	Hhaha, very nice from them for informing you with this. Going to check them out now.

01-16-2012, 02:49 PM	#4
Why MFBA Industry Role: Join Date: Mar 2003 Location: PNW Posts: 7,230	the logic used above is flawed, because crackers know what words and strings are used most frequently. so that shortens the list down tremendously. secondly, just because the average is 9 does not mean you can not crack using every combination of 6 or shorter, where 6 is the usual minimum user/pass length at many sites. not to say strongbox isnt a good solution, but their math is a bit off IMO.

01-16-2012, 03:15 PM	#5
iSpyCams Amateur Gynecologist Industry Role: Join Date: May 2009 Location: Medellin Posts: 4,436	They will hack your email (since the user is known) and retrieve the password. Or else buy a database of user and pass combos from another site and see if there are any repeats, so many people use the same combo for everything.

01-16-2012, 03:22 PM	#8
CyberHustler Unregistered Abuser Industry Role: Join Date: Feb 2006 Posts: 25,525

01-16-2012, 03:26 PM	#9
L-Pink working on my tan Industry Role: Join Date: Mar 2005 Location: Florida/Kentucky Posts: 39,151	My pet's name is on a sticky attached to the side of my monitor. .

01-16-2012, 04:22 PM	#14
2MuchMark Videochat Solutions Industry Role: Join Date: Aug 2004 Location: Canada Posts: 48,798	Interesting post, but it sounds more like a sales pitch. Using Brute force to crack a 9 character username + 9 character password is inefficient, and a very simple - too simple actually - way to code a hack program. A much smarter way to do it would be to first assess the users if possible to determine where most are from (say, North America). Most people use real words, real names, pet names, etc. A smarter hack would be to use the commonly used words from the North American dictionary, or most commonly used names (and pet names). Most people add "69" to the end of the name where numbers + letters are required, so a smarter program would have to take that into consideration. With a little bit of smart coding, it would take much less time to gain access to a server then the way it is described in your post. __________________ Custom Software \| Server Management \| Integration and Technology Solutions https://www.2much.net Last edited by 2MuchMark; 01-16-2012 at 04:24 PM..

01-16-2012, 04:22 PM	#15
ottopottomouse She is ugly, bad luck. Industry Role: Join Date: Jan 2010 Posts: 13,177	so... every time you double your number of members, your security is halved. people never guess the right password until they have tried every other possible combination. dinosaurs with short arms that would find it physically impossible to have a wank still love porn. __________________ ↑ see post ↑ 13101

01-16-2012, 04:38 PM	#17
edgeprod Permanently Gone Industry Role: Join Date: Mar 2004 Posts: 10,019	So if I can give you lists of Strongbox protected sites user/pass combinations, what do I win? Does that make me more powerful than God? Cool!

01-16-2012, 04:41 PM	#18
mikesouth Confirmed User Industry Role: Join Date: Jun 2003 Location: My High Horse Posts: 6,334	your site can be brute force hacked in a matter of an hour or so usually without fail. I wont expose the methodology they use but they truth is they arent randomly guessing passwords and logins, they use combos that are known to be valid. Im not saying strongbox isnt good...its the best...I use it and I strongly recommend it. But dont think for even a second that these brute force attacks are random guesses...they arent __________________ Mike South It's No wonder I took up drugs and alcohol, it's the only way I could dumb myself down enough to cope with the morons in this biz.

01-16-2012, 06:02 PM	#25
Relentless www.EngineFood.com Industry Role: Join Date: Aug 2006 Posts: 5,697	It's a very good sales pitch, and an even better product. What matters much more than the math is the fact that the owner of the product actually cares about whether or not his clients are protected. That means if anyone did ever successfully attack the software, it would evolve and prevent future attacks. With software you can not ever account for the unknown... You can update to overcome anything that eventually becomes known. Clearly Stronbox does a good job with that. I do not make a penny from strongbox. I have never met Raymor. Ask around and read his posts. That tells you all you need to know. __________________ Website Secure \| Engine Food ICQ# 266-942-896

01-16-2012, 09:57 PM	#30
Operator So Fucking Banned Industry Role: Join Date: May 2009 Location: ΠπΠ Posts: 2,419	Raymor ain't dumb

01-16-2012, 10:09 PM	#31
AllAboutCams Femcams.com Industry Role: Join Date: Jul 2011 Location: bjcam.com Posts: 12,221	i guess i should start know __________________ Binance - Blockchain and Crypto Asset Exchange Chaturbate make money in cams

01-17-2012, 12:34 AM	#32
2intense Too lazy to set a custom title Industry Role: Join Date: Dec 2009 Location: Google Posts: 12,450	__________________ Most Affordable Firewall & Malware Protection for Linux Servers

01-17-2012, 02:02 AM	#33
Operator So Fucking Banned Industry Role: Join Date: May 2009 Location: ΠπΠ Posts: 2,419	The wrong strong box ha

01-17-2012, 07:09 AM	#34
czarina Webmaster Extraordinaire Industry Role: Join Date: Jul 2002 Location: A beautiful beach... Posts: 10,745	Actually, we have received over 11,000 attempts since yesterday afternoon on one of our sites. They're still trying, but haven't gotten in. So yes, strongbox is doing its job

01-17-2012, 07:21 AM	#35
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	i guess people then should use strong user,pass combo as MUST small,big letters and numbers and min 10 chars for user,pass and you are safe __________________ BUY MY SIG - 50$/Year Contact here

01-17-2012, 09:05 AM	#41
tony286 lurker Industry Role: Join Date: Aug 2002 Location: atlanta Posts: 57,021	Raymor makes a quality product. I read this about pass phrases and have been using them instead of passwords for sites I go to. http://www.codinghorror.com/blog/200...s-phrases.html

01-17-2012, 09:11 AM	#42
lucas131 ¯\_(ツ)_/¯ Industry Role: Join Date: Aug 2004 Posts: 11,475	hacking one combo on strongbox take maybe unlimited time, but hack complete database with everything that is stored take few hours or few days maximum. oh poor dinosaur he cant hack strongbox

01-17-2012, 09:15 AM	#43
lucas131 ¯\_(ツ)_/¯ Industry Role: Join Date: Aug 2004 Posts: 11,475	oh and the best is, that threads like this about security are on gfy not new, but there is still most of webmasters who smile but use password under 8 chars. i know what i am talking about, go pimps!

01-17-2012, 10:22 AM	#45
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,405	That is all good... But if you allow your surfer to make their own username/password combo that all goes out the window. If you do... and you own Met-Art then I hack into X-Art with server level access and steal their combos... Now I have a list of tens of thousands of people that enjoy nude art sites and have all join the majority of them at one time or another. So by the time I run 50 combos on your site I am in 2 or 10 times or so...

01-17-2012, 12:28 PM	#46
michael.kickass Too lazy to set a custom title Join Date: Mar 2009 Posts: 11,039	__________________ NICERATIOS - $30 PPS - 50% Rev Share - 5% WM Referral - High Converting Sites! Any questions about your NICERATIOS account? Vanessa will take care of you: [email protected] Looking to expand your business in general, maybe sell your sites? Contact me: [email protected]

01-17-2012, 12:32 PM	#47
schiz Confirmed User Join Date: Nov 2002 Location: Middle of a cornfield Posts: 1,103	I've always had good experiences with StrongBox. With the right settings, you're golden.

01-20-2012, 05:11 AM	#48
Alex_ Registered User Join Date: May 2005 Posts: 1	raymor Are you going to respond to my emails?

01-20-2012, 05:19 AM	#49
Avalana Confirmed User Industry Role: Join Date: Jun 2011 Location: Coconut Grove Posts: 594	Anway, interesting read __________________ bad behavior - Adult & Porn Site Reviews - Need a honest Review for your Adult Porn Site? Just drop me a line - ICQ @BADBEHAVIOR or SKYPE avalana.porngeekz