CCBill Clients - Check your expired account logins
 

Hey guys, I have been launched for 30 days now and have been closely watching my program and have noticed that all logins are still working for expired users so I contacted support and they have done little about it but have said they are going to work on it, after that, the 4 reps i've spoken to haven't been able to find any issue. They haven't been contacted by anyone else about this issue which is surprising because I contacted another program owner venting about the issue and told him to check his expired accounts and he is claiming that some of his yesterdays expired member logins still work and some don't, so it's not just me. so if you guys could look into your expired subscriptions and see you might also be having the issue, could you please make it aware in this thread. Im not sure how long this has been happening for, it also might be intermittent so check all in the past few days and then if you find logins that still work, continue to go through as many as you can, I have a feeling you might find more.

To be honest, comments like this ""Our usermanagement feature is very basic and if a client is wanting soemthing more robust and possibly sure proof it is recommeneded that they create their own internal UM system."" - Larry D... do not make me very confident in ccbills system.

Sounds to me like another way of saying 'If you want a system without major flaws, create your own' - As if I should expect these kind of errors with the writing and removal of users to the password file.

paulk has confirmed he will be looking into the issue in the morning.

Are you sure your permissions for the htaccess file are correct?

I don't want to touch anything because if I screw around with it, I can't confirm it's their mistake or a bug.

They all received my FTP info and claimed there was no issue, so I am sure they checked the permissions or that'd be pretty silly.

Also another program owner confirms he is having issues with logins being removed, so it makes me think it's not the permissions.

Something has been up at CCBill over the past few days. My stats are off with the quick stats in particular being way off. And during this period there seems to be a pretty big drop off in sales.

One way to fix the .htpasswd issue is to wait until things seem fixed there and then request a new .htpasswd list from CCBill. That should remove the expired users.

I just checked and it is happening to me too!! WTF?!?!?!?!?

Yeah paulk told me that he would rebuild it (password file), however he also mentioned that it would effect anything else that uses the file. And I use a password security program that also uses it (like strongbox for example) and im not sure if that would screw that installation up. So I will wait to see if it's a bug they can fix without rebuilding it.

In the meantime, I suggest contacting ccbill and im sure they will be happy to remove the expired members manually. Or you can

Masturbate for free. yay!

This same issue has been going on for years. A lot of people get the password file rebuilt on a regular basis and then port it over to the other services using it.

See this is the kind of response I expect to get from support reps. How come out of all 4 support reps, I did not receive a response even remotely close to that. All of them implied there was no known issue.

If that was the case, I could have had it resolved before the problem occurred since I brought it their attention after a manual add never expired correctly.

Speak to some of the other solo girl program owners and you'll see how long they have been doing it. I can't remember the cause of it but it happens enough for them to request a rebuild.

I believe CCBill Paul knows about it.

Hmm interesting, thanks. I guess I have to keep an eye on it from now on. Sometimes letting your customers know of issues like this allow them to trust you more than letting them find out for themselves, especially new clients. It wouldn't surprise me if somebody went over a year without noticing such an issue. Then theres the people who let their programs go on autopilot while working on other projects, they surely wouldn't notice. Pretty big bug, imo.

Very disturbing so I checked a couple of my mainstream account with ccbill that has few members and I can see logins that are not longer listed as active members in the ccbill area. One dude signed up in June 2010, expired and logged in yesterday.. WTF

Sent ccbill support the details and waiting for a reply. The member as an example logged into more than one account even though he initially joined just a single account. Weird stuff...

Did he purchase both accounts? Maybe he didn't realize old account worked until he purchased a new one?

Can't say I know whats going on there without more detail.

Could explain some of the "bad ccbill sales" repports...

While checking for this I just noticed several canceled accounts that I was never sent a join email for. They were in the ccbill admin, but no notice was sent. Odd.

Tested around 10 users so far and none could get in.

Did you check the subscriptions that expired on the 23rd? I guess it's just some people, occasionally.

Thats strange about the no emails for the joins. Possibly went into the junk folder?

Only bought one subscription for one account so he shouldn't be able to log into several. Both accounts are on the same server though.

I checked on the 23rd, none of them have access.

But as I continue to search for expired members, I keep finding more and more that I was never sent a join notice on. They are not in the junk folder either, but they are in the ccbill admin. Guess there is a glitch in their mailing system. So long as they are in the admin, I'm not going to worry about it.

They'll say it's because of connectivity issues between servers at the time, it tries 3 times though, so not sure why it wouldn't work all 3 times.

I am seriously pissed now. I have found 6 working "expired" logins after just random checking!! WTF why didn't CCBILL make this known to me in the first place???

BTW... Autumn is beautiful. Great find.

Thanks, appreciate it! Yeah she's definitely a very pretty girl.

I'm not making any accusations or implying dishonesty, but merely to ensure all is well and that honest people remain honest has anyone attempted to verify with the customers who were able to get in for free months after they were supposed to be canceled that CCBill was NOT billing them while not giving you payment for the members in question?

We have had clients experience this problem in the past but it is actually quite rare.

I will contact you shortly so we can get to the bottom of it.

If anyone else suspects this problem please contact me so we can investigate.

Thank you.

Yeah I think I recall you once telling me it was rare when I had an issue regarding something else, that's why I shrug it off when they quickly jump to the idea of that being the issue with all future problems I have had.

Sounds good. Talk to you in a bit :)

Yep could explain plenty

We just had ours rebuilt due to a server move but I will definitely be keeping an eye on this in 30 days... there's no excuse for this kind of error.

It doesn't always work perfectly, sometimes one gets missed.
There has been times where it missed a lot of them.
From time to time, I have CCBILL rebuild the data base with current and correct info

One thing to keep in mind, I was also told, if a member expires becasue the rebill didn not work, ccbill tries 2 or 3 more times, so it could be a couple of days. How true this is today, I am not sure, as this was 4 -5 years ago.

Log into your CCBILL Admin run a members report, see how many active members you have. Then look at your user/pass file see how many you have. Again, you need to find out if the active members list includes ones that have expired and have days left on the subscription.

This has been an ongoing problem for at least a few years now.

We can't just do a fresh dump from CCBill since Epoch also writes to password file.

I spend a few tedious hours each moth manually removing expired accounts, all due to CCBill not working properly.

if they were wrong, they couldn't add users, could they?

This has always been an issue with ccbill. I have seen it for years!

That sucks...

Maybe CCBILL can write a CLEANING script, to remove dead ones.
They would have to somehow know what user/pass is theirs and not Epoch's.

I randomly tested 7 from this month and all were blocked.

Just incase you didn't see my other post, you should check all of accounts that were supposed to expire on the 23rd. Incase it's a recent issue

Yes, this is an old problem and discussed here many times (my me and others). Just don't go crazy on the 30 day thing. Unless the user specifically cancels, or it's a non-recurring billing, CCBill will keep the login active for 5-6 days as it waits to see if the customers wants to re-join. I recall that you can ask CCBill to turn this feature off if you don't want it.

You can do a rebuild, it will not hurt strongbox.

Since you are new, also make sure the member is 100% expired. I know some people see the red account in ccbill and the member has canceled his membership, but still has days left on the membership he piad for. Keep in mind also to wait several days after the rebill fails, as ccbill told me they keep trying 2 or 3 times to rebill the customer.

But, bottom line is, YES there is a problem, and most people have just put in a few extra hours doing manual removes, or rebuilds. It would be nice to have this fixed, yep!

I don't think it's a 5-6 day thing, I have manual added logins that have been working for a long time after expiry. That's why I was worried subscriptions would do the same thing, that's why I knew right away. I couldn't show ccbill the manual adds still working because there is no report to show expired manual adds. So I waited until first subscription ended and took it to support.

And regardless of it's been discussed before, I would have made the thread anyway because I don't see CCBill telling anybody, so I am sure it needs to continue being brought to peoples attention.

Actually I am using password sentry, not strongbox, i just figured more people knew strongbox. Pretty much same thing? Im actually not familiar with strongbox.

And yeah it was confirmed that they were supposed to expire last night at 11:59.

That would be a great solution.

Speaking of manual adds.... another disturbing observation for us recently was we discovered a pass sharing site about 2 weeks ago but what was bizarre about this password post was this...

We had manually added 3 logins and pass for close trusted friends. All 3 of The manually added logins were posted on the forum. We did not notice other logins posted on this particular password forum.

But the 3 exact manually added logins within the past year were posted.

So is it safe to assume that our manually added logins are compromised/hacked not secure? Can anyone make sense of that?

I am not sure what you mean by bad ccbill sales reports. We are currently investigating an issue we had with our quick stats overnight. However, to my knowledge all of the other reports are and have been functioning properly.

The problem described here by the OP and others is simply with our systems ability to remove usernames and passwords from the password file located on the clients servers. For example, customer John Doe is due to expire and be removed from the password file on the 23rd. Our billing system knows this and when the 23rd hits our system sends a remove command to our user management script located on the clients server. There are numerous reasons why we are not able to remove a user and our teams are working on resolving these once and for all but I can assure you the reports and the removal of the users from the password file are two separate systems. We always know when the user is to be added or removed but we are not always able to perform that function.

Back in the old days, hackers would hack the ccbill file. I thought this was taken care of, but yes, I use to find my entire user/pass lists on boards.

NO it was not my server hacked, I did extensive research on how people would crack the ccbill files. I have not heard about it in a long time, so I figured it was over.

Paul you are a great guy, and about the only one to get issues figured out. THANKS!

CCBILL rarely has a problem ADDING members, yes emails are sent that you could not. Never, have I had an Email saying you could not remove a user. I understand money wise the focus is on the sale and getting the member happy and able to login, so that would make sense that user removes are put on the back burner, or only ONE attempt made.

I bet the percent of users not removed is fairly small compared to the number of total joins ccbill does daily. Today with it harder to turn a $, this has become an important issue with webmasters who know this is happening.

No bashing on CCBILL this time, as we all know errors happen, just hope to have a little more effort in a clean up process!

It happens/has happened to us also, however, you can request the password files for all subaccounts on a month to month basis; that's what I do.

I know it's not a valid solution since it's CCBill's system NOT doing its job, but I think it's wise to be doing maintenance on your password lists anyway :2 cents::2 cents:

What I meant is that the problem isn't new, and isn't just yours. They've had this issue for YEARS. That said, one could argue that it's really the Webmaster's responsibility to oversee the integrity and accuracy of data on our servers. That's reasonable, but it's also reasonable for CCBill to say that -- under certain and unknown conditions -- it might be necessary.

You can track what their script tried to do by looking into the ccbill transaction and error log. Both are tucked in the cgi-bin folder with the CCBill user management script. Simply fetching and reading this file offline won't interfere with anything.

You mention manual adds, and using Strongbox. I take it the manual adds are in the CCBill admin, and not being made in Strongbox. Obviously, CCBill has no knowledge of users you add or remove via the Strongbox control panel.

Long ago I set up a couple of Word macros that strips off all but the username in the htpasswd file, and sorts it. It's a macro you can record, and isn't complicated. You can then download a member list from CCBill. Include only usernames. Now do a document compare between the two. You'll instantly see any usernames that shouldn't be there.

If you have more than one biller you'll need to combine the active username lists from all of them. Last time this came up Ray of Strongbox indicated he created a script within Strongbox to do all this. I don't know if it's something that costs extra, or what, but you may want to ask him about it.

yeah but I'll bet your retention ratios are jammin'