Attention Management and members

[4hams]

I have recieved this message twice in the last month.

Dear 4hams,
Your account on Digital Video Forums has been locked because someone has tried to log into the account with the wrong password more than 5 times. You will be able to attempt to log in again in another 15 minutes.
The person trying to log into your account had the following IP address: 72.233.34.186

The last time this happened I researched the IP address and it was owned by Go Daddy Software. Obviously not a company to be trusted.

The management here knows my IP and in cases like this should have banned the offending IP!

I think the members here and on any forum deserve better security than this message!!!

[gonwk]

Hi 4hams,

What the heck would they gain by logging into this type of forum as you or any one of us. It is not like they are giving away $$$.

Or may be I am missing the point.

Thanks,

G!

[4hams]

Personally I do think you are missing somthing!!!

How would you likr it if someone logged on as you and then made some really stupid posts that are not of your character?


The management should have banned the IP addresses and then sent me a message that someone with a different address was trying to log on with my username.

I also find it a little annoying that the management here did not have the balls to reply to this post with possibly an explanation and a change of action in occurances of this sort!

[admin]

4hams: please search the forum, this topic has already been covered:

http://forum.digital-digest.com/showthread.php?t=82459

To summarise, the forum has built in security features which prevent the hacking of your account, hence why you get emailed about the hacking attempt and the temporary lock. While you get an email, I don't actually receive any notice of an hacking attempt, so unless you contact me through email or post the IP address that attempted to hack into your account, I will never know about it.

Although the IP address is different from last time, but it seems to come from theplanet again. I will email them a abuse report. Meanwhile, I might have to disable the list members page.

[admin]

And the reason I'm not emailed about possible "break-in" attempts is that sometimes these are just legitimate users who have forgotten their password, and so I might get dozens of "attempts" each day, some legitimate, some not. What the system should do is to automatically ban IP addresses after the IP address attempts to (unsuccessfully) login to more than 3 accounts or something, but unfortunately, the system doesn't do that.

I have disabled viewing member lists for certain user groups, which might help to prevent these kind of attacks (scanning through the member list and then trying to do a dictionary login attack on the members is what could be happening - most of the members that have been affected have been listed on top of the member lists, ie. their username starts with a number).

[4hams]

Thank you for the reply and yes I should have searched the topic first.

[jwo62]

I am glad to learn that this security measure IS in place.
________
Bmw x-coupe

[soup]

Ditto.