Reply to: website security

[NewbieContractor]

"It is somewhat alarming that clients task a newbie contractor, who freely admits, web is not their strong point, with securing what is in effect sensitive information."

Just goes to show.. if you can pull the wool over your clients eyes and sell yourself well.. then you can get a nice contract out of it

[ratewhore]

You can not class a site as secure if u can see the password in the source code..

It'll be fine - it's base64 encoded...

[RW in 'just so you know - thats irony' mode]

[threaded]

dickhead - sorry i mean cliphead

Knowledge is basic - but not THAT basic..

You can not class a site as secure if u can see the password in the source code..

Security through obscurity is no security at all...

Or did you mean to say it's something you have and something you know...

[_V_]

It is somewhat alarming that clients task a newbie contractor, who freely admits, web is not their strong point, with securing what is in effect sensitive information.

No wonder so many projects go tits up.

I am going to put all the banks PIN numbers online, but will ask criminals to look away from the monitor when I display them.

No peeking!

[NewbieContractor]

Ok - to protect important info

[Ardesco]

Would you not classify that as important then?


I would.

[NewbieContractor]

because there is a degree of sensative info - i.e. company calendars etc.. internal contacts etc..

[Ardesco]

What is the point of making it secure if you aren't protecting anything importnant ?

[Cliphead]

Read the page:

"Do NOT protect anything important with a script like the one below. Either get Coffeecup's password wizard, find a CGI Script or ask your web host to set up an .htpassword file if you need to protect important information."

[NewbieContractor]

dickhead - sorry i mean cliphead

Knowledge is basic - but not THAT basic..

You can not class a site as secure if u can see the password in the source code..

[Cowboy Bob]

Have a look at this for simplicity

http://www.2createawebsite.com/enhan...d-protect.html

LOL, what's stopping someone just navigating directly to page2.html in that example?

I know HTTP basic authentication isn't 100% secure, but it will keep all but the most determined hacker out. As for that script...

[Cliphead]

Have a look at this for simplicity

http://www.2createawebsite.com/enhan...d-protect.html

[NewbieContractor]

Maybe i should mention, that net security is not my main skill in life.. so as simple ways as possible is always helpful

Thanks so far!

[DimPrawn]

You can do this on IIS by turning on any of the authentication methods and switching anonymous access off. When someone logins in, a popup will automatically ask for the user to login. You then need to ensure that they have a user account on the server!!!

If you do this, bear in mind that each user will require a CAL on the webserver.

Alternatively, buy an ISAPI filter that allows you to use Basic or Digest Authentication but store your users in a database or text file, negating the requirement for Windows CAL's

[Weltchy]

You can do this on IIS by turning on any of the authentication methods and switching anonymous access off. When someone logins in, a popup will automatically ask for the user to login. You then need to ensure that they have a user account on the server!!!