Originally created 05/30/97

Online publishers battling password sharing



In the ESPNet SportsZone offices, it's called "the frat house effect."

Producers of the subscription-based online sports site watch their logs daily for unusual log-in trends.

While the average visitor generates about 40 "hits" to the site, a few user names come up with as many as 1,000 hits a day, said SportsZone executive producer Jeff Day.

"That's the frat house effect," said Mr. Day. "You can figure that anyone with 1,000 hits is sharing their password."

He knows that fraternity members around the country save their "brothers" money by letting them into a site they've paid to access, whether it be SportsZone, Playboy or Penthouse.

"They're probably the biggest password abusers," Mr. Day said of fraternity members.

But college-age sports fans aren't the only ones giving away log-ins and passwords to subscription sites, and taking revenue from Web page creators. Everyone from Fortune 500 executives to teen-agers in pursuit of sex-related Web pages is using shared passwords, many of which are posted on newsgroups and Web pages.

Producers of these sites say the problem is still small, but it's growing. More of them make users sign subscriber agreements that are comparable to licensed software agreements.

"People know that they can't give Microsoft Office to 20 people, and we hope they will take that same approach with us," said John Lerner, electronic publishing product manager for Adweek magazine.

The contract for Adweek, which charges $14.95 monthly for the online edition, reminds users that "this is for your use only," but Mr. Lerner admits that many subscribers disregard the warning.

Mr. Lerner said he knows from off-the-record conversations with subscribers that some companies are taking articles from Adweek's online edition and posting them on company intranets.

"That's a violation of the contract," he said.

But Adweek hasn't aggressively pursued subscription abusers yet, he said.

Most online managers say they're still trying to figure out how best to deal with the problem.

At Playboy, the strategy is to let abusers know they're being watched, said Paul Fieth of Playboy New Media.

"We'll first send a courtesy e-mail, saying this: `Somebody might be using your account and you may want to change your password.' That's just to let them know that we know" they're probably passing the password around.

Mr. Fieth said passwords for Playboy and other sexually explicit sites are easily obtained on the Net.

"There are a couple of newsgroups out there with the sole purpose of sharing passwords," he said. "That's the big thing happening right now, and the only thing we can do is carefully watch the user logs."

At most, he said, a single subscriber should be able to download 300 megabytes of files daily.

"If a user grabs 1,000 megs in a day, we'll investigate."

There are also private password-sharing boards, Mr. Fieth said, on which a person can get into a club of sorts by contributing one good password. In return, a user gets 100 passwords from other members.

"I have almost 100 working passwords to trade for a working Penthouse password," wrote one poster on the Penthouse newsgroup recently.

But Penthouse magazine's online czar said that he is aggressively fighting misuse of online subscriptions and that he's watching the magazine's newsgroup for abuse.

"Our tactic is simple," said Marko Verdi, director of New Media technology for Penthouse. "We've made a broad assumption that a person could be coming into our site from three different host names - maybe from a work station, a laptop and a home computer. If they come in from more than three, they're issued a warning."

On average, he said, about three or four subscribers are notified weekly of possible account abuse and assigned a new password.

"They get their second password by e-mail, which lets them know that we know who they are," said Mr. Verdi.

Mr. Day of ESPN SportsZone said his staff is developing unusual features to encourage password secrecy among subscribers. SportsZone subscribers are able to participate in fantasy team games and manage their team's moves from their account.

"You're exposing your team to malfeasance if you let somebody else use the account," Mr. Day noted.

For Wall Street Journal Interactive, adding premium services at the subscription site has discouraged password sharing, said Tom Baker, the online newspaper's business director.

The site's 80,000 subscribers can order articles from other specialty publications for $2.50 per story, which is charged to the subscriber's credit card.

"It's a disincentive to share the password because somebody could end up charging a lot of things to your card," Mr. Baker noted.

He said the addition of premium services uncovered some account abuse.

"People called us up and complained about their bills, saying they never downloaded some stories that they were charged for," said Mr. Baker. "Then in diagnosing the situation, we asked if somebody else was using their account and maybe they retrieved the stories. And then they'd say, `Oh yeah, my brother.'°"