[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130311221003.GA8852@openwall.com>
Date: Tue, 12 Mar 2013 02:10:03 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: OT: HTTPS for openwall.info?
On Mon, Mar 11, 2013 at 10:34:51PM +0100, buawig wrote:
> > any chance openwall.info will be reachable via HTTPS any time
> > soon?
>
> Any information/opinion on that?
I have no current plans to spend/waste any of my time on this, sorry.
Just use a unique password that you're not using elsewhere. HTTPS or
not, you should be doing this anyway, because the server might get
compromised and because you shouldn't trust us, the sysadmins, with
credentials to your other/unrelated accounts. ;-) As to someone
possibly capturing your password and making a wiki edit, it's not a big
deal. Anyone could simply register for an account and make an edit, and
we're monitoring the wiki for possible vandalism anyway.
If we had many more users register for wiki accounts, this could be a
high priority task, but as it is it appears relatively unimportant to
me, compared to other things I might spend my time on (affecting
security of larger numbers of users or/and in more important ways).
OK, here's one good reason for us to offer HTTPS access to the wiki
anyway: the example we provide to other sites accepting user/password
logins, including sites with substantial number of users. Maybe this is
in fact a reason for us to do it ourselves.
BTW, DokuWiki uses md5crypt (at least the version we have deployed).
If we were serious about improving the security of our wiki, we'd need
to patch that, but frankly I don't bother. Irresponsible of me? In a
way, yes, but there are just so many other things to spend time on.
If anyone wants to review what password hashes new versions of DokuWiki
use, and maybe patch that (perhaps to use phpass, which would default to
bcrypt on recent PHP) and submit the patch upstream, feel free to work
on that. It'd make more of a difference for the world at large than
patching or/and SSL'ing our one DokuWiki install.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
