prevent password (account) sharing

[Ruth]

Could someone help me with this hack please, i am trying to prevent password sharing in vB, the hack is based on:

(a) limiting access to a specific account per one ip adress at the same time.

(b) if there are more than one ip adress, for the same account at the same time, the account will be reported to the administrator.

(c) limiting access to one account to a number of ips/day, for example if the there are more than 10 ips/account/day the account is reported &/or deleted.

Thanks

You could present problems with IP restrictions. I, for example, login from home and work each day... so I have 2 IP's that I would come from and be reported every day.

Most modem users and all AOL users will get a different IP each time they log on. So if I have to get on and off because a family member needs the phone, I could have umteen IP's each day as a result.

I'm not positive on this one, but I think you can actually switch IP's with AOL while in a session. They can change you IP from just clicking from page to page.

[Ruth]

, for example, login from home and work each day...

true but you wouldn't be using this at the same time i.e you will not be at home and work at the same time.

Dynamic ips

i myself use a dynamic ip, thats why i asked for this option to be reported at least if not deleted, so that i can compare the ip adresses, dynamic ips will result in the last 3 numbers to change...

111.222.333.444 (444 in this case and sometimes 333) but it will be under the same company which is AOL for example.

also if you can set the number of ips/day to a certain number say 10/15/20 ips depending on the nature of users, before an account that can be deleted (if you want this option, otherwise reporting in dynamic ip community)

cheers,

If someone made this I would DEFINATELY implement this in my board...plus I would kiss their feet...lol...

I always thought that.. all ISP and everyone had a common ip..

lets say I have 207.1.7.222..

I always thought that atleast 207.*.*... was the same, it was the number after that..

[MrLister]

it is. users on cable almost always start with 24.*.*.*

[GameCrash]

Why don't you work with cookies? It would be easier and better (I think)...

[Ruth]

There are 2 type of IPs:

(1) Static IP
where the whole ip is the same...this is found on cable users...

(2) Dynamic IP
where the last few numbers change, but the DNS of the ip will show the same company (ISP), this is found on most dial up connections, and it changes with every new connection.

(3) Nevermind IP Spoofing

Why don't you work with cookies? It would be easier and better (I think)...

GameCrash, i can't understand exactly how you want to use cookies for that purpose.

The idea of this hack is very protective for vB, for a simple question which is "what would be the case if 2 users logged to the same account in vB at the same time with 2 different ips?

Is there any security in vB for that?
Will it report this to the admin?
Will it delete the account?

All this will result in the account being abused, especially when it is not that easy to be a member of a certain vB, like mine

cheers,

[dabean]

You shouldn't assume that the first section of IP address will not change because most of the larger ISPs have IP allocations in completely different blocks. For example the US cable co roadrunner could dynamically allocate you a 24.x or a 65.x another example is aol where you could get 152.x or a 205.x or 172.x etc....

Secondly if the isp or the person browsing is using a proxy there is always the risk of recording the proxy address not the actual users address. In theory all proxies should forward the user ip but in reality many don't including some "transparent" proxies used by ISPs.

[Ruth]

For example the US cable co roadrunner could dynamically allocate you a 24.x or a 65.x another example is aol where you could get 152.x or a 205.x or 172.x etc....

as i mentioned before in this case the DNS will show the same for the company or ISP

the person browsing is using a proxy

Again, each user will have a limit of 10/15/or 20 ips/day, and after at least a week of recording the ips, you will know if thats a regular ip (or proxy) used by that user.

And why are you making it so complicated, take life easy, how many people will use a proxy? and if you find someone using a proxy s/he will probably use it forever (instead of showing the regular ip) not only for my vB!

take the idea of the script easy...start by understanding the need for detecting 2 users logging at the same time with the same account...don't go further...at least for now

cheers,