Ways To Prevent Sharing Passwords To Access A Site?

IP address is definitely possible.

But remember this: build into your price the cost of customer service. You will inevitably get someone who says "I just moved to another state with a different internet company, and now my membership login does not work."

For someone like that, you will need to deactivate the old one, and activate the new one.
That takes time, and time equals money. So build that into your price.

Also, make it very clear that your membership logins are tied to the IP address. You don't want someone thinking they can login "from anywhere in the world" when in fact they have to log-in from a specific IP address.

If you don't want to deal with the customer service of IP address updating, you could have passwords set to expire every 60 days. Then they get an email with their new password. Someone could still "tell everybody" their new password. But you will probably wear people like that out over time. And any lost revenue from that set up could be offset by less need for customer service, and less hassles about people's IP addresses not working and needing updating.

A really cool idea would be that you can only post new information from your pre-defined IP address, but if you are on the road, you can log in with a "view only" mode. I don't know if anybody has that technology set up.

A lot of software companies have computer pinging. The software "learns" the exact computer, and the software will not work if the query discovers it's not an authorized machine. That's even more restrictive than IP address.

This whole thing falls under the category of "digital rights management".

Fortunately, this whole membership site thing has evolved and it gets better all the time. I don't think you will have a difficult time finding a "membership site in a box" solution that provides access restriction levels that meet your needs. You'll probably want to shop around to find one that has all of the video features you want and other things.

Hi,

You can certainly capture the IP address.

You can also use a geo-location script, and capture the results.

If you see the same user credentials being used from multiple states/countries within a suspiciously short period of time, you can then make an informed decision whether or not to disable the account.

I would recommend monitoring all this stuff on the backend of your delivery funnel anyway if it's a potential problem for you (cost/bandwidth etc).

I wouldn't try to enforce a strict IP address-only policy, though. People access the internet at home, at work, in hotels, in cafe's, on their phone...everywhere these days.

Steve

log the IP, and kick other logs (using the same id/pw) out when new IP comes in. Claim this clearly on site. hopefully, paid users will not share the login.


david

If you have a script that can do so,

Set the membership login to automatically lock you out if you log in from more than 2 or 3 IP addresses in a single day.

I'm a member of a membership site that does that

I think that they're using Amember

http://www.monster-submit.com/sentry/
http://www.pennywize.com/

... don't know anything about any of them or the scripts so use due diligence.

An article covering additional options ...
http://www.newmedias.co.uk/your-minder/prevent-password-theft/

If you have a concern about this don't forget about brute force attacks. A good hacker can actually guess a user/pass combo faster than some can share the login with others.

Moving on ...

Way back in the day I had a script that did just as Illumination outlined. It might have been Amember but I'm not positive. I'll check my archives for it but it may be too old to work in today's hosting environment. I'll come back and let you know if/when I find it.

In the meantime how about finding out if you actually have a problem by putting something like this at the top of the main member page.

"Your IP of XXX.XXX.XXX.XXX has been recorded. We have installed a login monitor system that detects the number of users logging in from different IP's using the same user/pass combination. If your login info is found to be used from several IP's you're membership will be automatically terminate with no refund of monies paid"

You then can use a number of scripts that display the users IP to fill in the XXX.XXX.XXX.XXX with their actual IP.

In PHP it's pretty easy ...

IP Address- PHP Tutorials- Depiction


Then check your logs every now and then to see if you need to actually go beyond the bluff.

PM me if you would like/need some help with this. It's been a while but I'm sure I have something left from when I did work for adult site webmasters.

would not a simple free forum script / ? smf handle all of this stuff as it would give private user group based permissions and handle all of the ip address stuff or am i in the wrong car park.

You're welcome Bob ... Glad you found that info useful.

You can consider checking LoginEye out!

They are a third party security solution that enables businesses to identify login sharing behaviour and prevent it.

If none of the above methods works for you, why don't you get yourself a free trial from them?