Pulse Protection for Metis

[Pri]

This is a new script that has been in closed testing for a couple months now. It basically tracks all the usernames that an IP has used. It then reports those usernames and IP's to my server and the server sends that data to other people who are using the script. However All data sent to the server is signed by a password and only people using the same password can access the same data.

So for example if I was using the script and used password 729172 and you used the password 1727192 I would not be able to see the data you send and you wouldn't be able to see the data I send. You can share your password with your friends so that you all share the same data to increase the amount of data accessible to you.

This is a script to help you to keep track of people who use multiple chat clients, clone other users, general nefarious users and so on. In future versions I intend to include Tag identification and other general useful security things. I mainly just made it because I wanted to see if it can be done and it's a precursor to some other more fun and not security related things I want to release later on

Link: http://www.mxpulse.com/board/viewtopic.php?f=9&t=238

If you encounter any problems, let me know!

[shakes]

  Good job Pri.
More to come i hope

[Blitzen]

I do not agree with users ip info being stored by a third party and who knows what other information. If it fell into the wrong hands then .............  and theres ip`s being blocked on the wmw blocklist for monitoring users how is this any different, and since when has winmx chat become policed by Pri as in effect by providing such a service it has got to be seen as that surely ?

[Pri]

Don't like it, don't use it.

Also the only information stored is the Username attached to the IP. That's all. The scripts source is there and you can see all the data sent to the server. It sends three things, Name, IP and Password. And if the information fell in to the wrong hands then ... Nothing would happen. The usernames and the IP Addresses don't mean anything. And why would they?

Websites know more about you from you just surfing around than I'll ever have in 10 years of running this alias tracker.

And I'm not policing anything. I am empowering hosts by giving them the information they want (And yes I've been asked for this and other tools) to make informed decisions. I only make what people want.

[Bieb]

Don't like it, don't use it.

Also the only information stored is the Username attached to the IP. That's all. The scripts source is there and you can see all the data sent to the server. It sends three things, Name, IP and Password. And if the information fell in to the wrong hands then ... Nothing would happen. The usernames and the IP Addresses don't mean anything. And why would they?

Websites know more about you from you just surfing around than I'll ever have in 10 years of running this alias tracker.

And I'm not policing anything. I am empowering hosts by giving them the information they want (And yes I've been asked for this and other tools) to make informed decisions. I only make what people want.

I think Blitzen may just want everyone to have less protection. The more rooms he can flood the better.

[Pri]

He's entitled to his opinion. But I don't think there is really any security issue here. Also I should just point out that when multiple people are sharing there data the data isn't given to all of them all the time. They are given data from the 'pool' only when a user with an IP that is present in the database is found. Then they are sent that persons data and only that person.

So they can't just link up to a large pool and download thousands of IP's and usernames. They would first need one of the people in the database to enter there room. I just wanted to make that clear before the discussion continues in-case anyone got the wrong impression on how the sharing of data works.

[wavparty]

IT is an excellent ideal and a wonderful script, well created - works perfectly.   Anything that makes our community safer, and at the same time lowers the amount of spamming these childish idiots are doing is great! I am very happy to be part of the testing process and will continue to offer my room for whatever new and innovative things you wish to send my way!  I don't see anyone else offering new things to our community and I don't view your efforts as an attempt to 'TAKE OVER THE MX UNIVERSE'.  Thanks keep up the good work! I'm extremely grateful.

[shakes]

This is not policing,this is stopping  spammers That ruin mx chat rooms.No one is making you use it.

If the people that do spam rooms would stop,then we would not need such a program,which i don't think they will.
So i for 1 will use it to keep the scum out of WinMx chat rooms. Up To you Pri.

[Bieb]

Also keep in the mind the agreement that you make when you enter the chat section of the WinMX application. You agree that it's unmoderated meaning anyone can do/make anything they want to and collect any information they want. You agree to let them.

[Blitzen]

How does this make your rooms more secure it does nothing but collect user information, iam certain if someone wanted to spam your rooms theres many ways to do so and Pri will never be able to stop it. Although i am not raising concern of user information being stored by Pri for myself as i have not used winmx for a few months now but if i was using winmx i would be concerned that Pri is storing winmx user information on his server via any room host who uses this script. Hey yeh it maybe a good script but does anyone really know anyone on here or their real motives !!!

[Pri]

I host a cache for WinMXWorld if I wanted to I could collect the IP's from that. As could any cache operator. I also have people contacting my server all the time for the IMDB script and the Proxy Blocker script I could harvest IP's from that also.

But can you actually think of security issues stemming from me having your IP's? What exactly could I do with those? Sell them to the MPAA 'Hi these are the IP's of people using a script I wrote' I'm sure they'd love to sue you for doing nothing illegal what so ever.

The Proxy Blocker stops spam from users using Proxy Servers (99.9% accurate at detecting Proxies!) and this just helps to keep track of people who change there name often who don't use proxy servers. Simple as that really. And as before only people who give data can receive data and the data you can receive is quite confined and I am a trustworthy person who already has access to much much much more data than this little script and yet I don't use it for anything because 1. The data is all useless anyway and 2. I don't have nefarious aspirations.

But please if you want to keep saying collecting user information in this manner is bad then at-least give us 1 way in which this data could be misused. Literally any way please. Just one way.

[Bluey_412]

He wont cos he cant...

He's just objecting cos it might put paid to some of his room-spamming activities...

[Blitzen]

Read up Bluey i dont use winmx ............. and Pri the information you retieve called be requested by any anti p2p group what you may think as being useless may be ideal for someone else. Any logged user activity to me is just makin the whole internet less freedom. And if you think your proxy list is secure Pri then think again lol

[Pri]

You obviously don't know how the Proxy Blocker works because it doesn't even use a Proxy List anymore. It now uses a definition file like an Antivirus to determine if an IP belongs to a proxy service or not. And that is what allows it to detect 99.9% of proxies. Feel free to download it and try it yourself I'm that confident in its ability to block proxies.

And again the information the IPs etc are completely useless to MPAA/RIAA and any other Anti-Piracy groups as the IP's are not stored with times or dates that an IP was using a specific username on WinMX, does not contain a list of files from any user and the data can be tampered with before uploading to the server. Making the information completely inadmissible in any court.

But please if you can figure out a way that the information could actually be misused let me know.

[gypsyroadhog]

I'm trying out this script
can you tell me where all the info gets stored please
i see a folder called  Pri.Script.Dependencies
within that is a folder called    Pulse.Protection
within that is     .password.ini   and    .Pulse.Protection.ini
but i dont see any entries of     user name,IP etc
all i see is the figure "1" in the .Pulse.Protection.ini

[Joshua203]

have you looked at the xml gypsy? i think the anwer would be ..on the webserver

[gypsyroadhog]

not sure what you mean Josh sorry

[Bieb]

The information is stored remotely. Therefor you are not going to find it yourself on your system.

[Joshua203]

Sorry if my answer was a bit short but Bieb allready explained it ..thanks Bieb

[gypsyroadhog]

Okies i understand that
but why does mine only display this

[OpMsg] <Dad..> Pulse Protection (v0.7a): Also known as: , 

no other info appears and i havent altered any of the script
and yes i have included    <include file="Pulse.Protection.by.Pri.xml"/>
in Plugins MXC