BIG Problem with security. ----- Help needed fast..................

[andressmontoya]

Hi,
I have a big problem with accounts sharing. Users use same account ID and password to access restricted areas, so they don’t have to purchase the package.

For example: take 3 users: Adam from UK, Kelvin from USA, Mark from Russia
When Adam purchases a package, the package shows up only in his account.
But when Adam gives his ID and password to Kelvin and Mark, they log in to Adams account from their home and view the package for free.
For this, somehow I need to stop multiple logins from same account.
If I use Vbulletin 4, is it possible to accomplish that?

Thank you
Andress Montoya

[Zachery]

Its not currently possible to acomplish this.

[HydraulicJack]

Zachery, are you saying that multiple users can be logged in simultaneously using the same username and password, or only one at a time? If plural, isn't that a flood hole?

[andressmontoya]

I know amember can do this, since its not a forum, i have no use of it.

[andressmontoya]

will it be possible anytime soon

[RadioErewan]

On vb.org there is multiple login prevention script (for vB3.8). It informs admin when two logins are used on single computer (as far as both sessions use same folder for cookies).
So it is possible to know Kelvin and Mark are using two accounts (it will tell you nothing if Mark and Kelvin has no his own account on your site).
It is not solution, but might help in solving the problem.

[beishe8]

For example: take 3 users: Adam from UK, Kelvin from USA, Mark from Russia
When Adam purchases a package, the package shows up only in his account.
But when Adam gives his ID and password to Kelvin and Mark, they log in to Adams account from their home and view the package for free.

It is possible to modify the code to log their IP address and with a username only from that IP address to login.
The problem is that your users must have static IP addresses.
Some of the users might have dynamic addresses they won't be able to login when their IP address changes.
If they try to login from their family,friends computers they won't be able to.

[RadioErewan]

One session per login allowed would be enough. One IP per login (changed every successful login) also could help and penalize account owner.