OK, we're are doing "everything" we can to prevent the bastard script kiddies to crack/share our passes.. E.g random generating of their passwords and we're 99.99% sure the add member cgi is secure, so would it be safe to assume the shared passes are legit sigups paid with stolen cards? This seems scary, but we can't seem to find any security flaws that would make it possible for bruteforcers to get the combo's from our system and we see no signs of BF attacks on the servers... please advise!!
We're using password trojan to monitor the logins.. not the best program
