4 ms·

I've actually got a Jekyll + Github Pages[0] setup that I've managed to password-protect pretty effectively[1]. Essentially I took my wife's wordpress content,

I've actually got a Jekyll + Github Pages[0] setup that I've managed to password-protect pretty effectively[1]. Essentially I took my wife's wordpress content, ported it to markdown, and slapped ALL the content inside a directory named used the password hash. So you basically have to know the password to get to the right directory. Is it perfectly secure? I don't know. Does it discourage creeps from looking at pictures of my kids? Yep. [0]: https://dsheldon.com/technology/github%20pages/jekyll/2019/06/09/getting-started-with-github-pages-and-jekyll.html https://dsheldon.com/technology/github%20pages/jekyll/2019/0... [1]: https://faithfullyinfertile.com/ https://faithfullyinfertile.com/

onion2k 6y ago
...slapped ALL the content inside a directory named used the password hash. So you basically have to know the password to get to the right directory. You could attack the site by cracking the password to get the hash, or you could work out a way to make the web server list all the available directories instead. Historically that has always been a very common way to attack servers. You've changed the thing that's protecting the website from password hash to a web server config. It only takes a simple mistake on the part of Github to enable directory listings and everyone will have access. FWIW I trust that Github won't do that and I think you'll be fine, but as a method of securing something on the web using an obscure directory name is a terrible idea.
- twodave 6y ago
  Well, for one, "cracking the password" in this case would take an attacker much longer than just going to find some other family's blog to creep on. And there is no entry point for a directory listing (default page is being taken by the password prompt, no other directories are present), but if, for example, GitHub accidentally made my private repository into a public one, it's just a matter of changing a directory name to reset the password. The content being protected here isn't nuclear launch codes, it's just family pictures/journals--so we don't need rock-solid (and annoying to set up/maintain) security, but just a deterrent much the deadbolt on our house's front door.
- hanniabu 6y ago
  What if you literally just encrypted the page contents, share the password with your friends, and decrypt it with js?
  - twodave 6y ago
    One could--but that would be a lot more difficult to work with (if one ever wanted to, e.g., write a new post it becomes out of reach for my wife who isn't a programmer)
swiley 6y ago
All of your content will be publicly accessible in an automated way that requires no understanding of your site if github turns on PROPFIND and there are dozens of reasons (many good) why they would. If you actually care about the content on that site staying secret you should delete that repo and find a different way to share it.
- twodave 6y ago
  All the contents of my house are publicly accessible to anyone who wants to break a window--this data is less important than any of that stuff, I just didn't want it sitting out on the curb, so to speak. Edit: I hadn't thought about WEBDAV being an entry point, though--thanks for pointing that out.
  - swiley 6y ago
    Automated crawling is way different than physically breaking and entering. One is a (legal!) routine process executed by robots and one is a serious crime that requires will, forethought, and physical presence.
    - twodave 6y ago
      Automated crawlers were not the threat I was trying to guard against--it's more the 40 year old creep looking for pictures of kids on people's blogs and being bold enough to leave disgusting comments that I wanted to get away from--problem solved.

onion2k 6y ago

...slapped ALL the content inside a directory named used the password hash. So you basically have to know the password to get to the right directory. You could attack the site by cracking the password to get the hash, or you could work out a way to make the web server list all the available directories instead. Historically that has always been a very common way to attack servers. You've changed the thing that's protecting the website from password hash to a web server config. It only takes a simple mistake on the part of Github to enable directory listings and everyone will have access. FWIW I trust that Github won't do that and I think you'll be fine, but as a method of securing something on the web using an obscure directory name is a terrible idea.

twodave 6y ago
Well, for one, "cracking the password" in this case would take an attacker much longer than just going to find some other family's blog to creep on. And there is no entry point for a directory listing (default page is being taken by the password prompt, no other directories are present), but if, for example, GitHub accidentally made my private repository into a public one, it's just a matter of changing a directory name to reset the password. The content being protected here isn't nuclear launch codes, it's just family pictures/journals--so we don't need rock-solid (and annoying to set up/maintain) security, but just a deterrent much the deadbolt on our house's front door.
hanniabu 6y ago
What if you literally just encrypted the page contents, share the password with your friends, and decrypt it with js?
- twodave 6y ago
  One could--but that would be a lot more difficult to work with (if one ever wanted to, e.g., write a new post it becomes out of reach for my wife who isn't a programmer)

swiley 6y ago

All of your content will be publicly accessible in an automated way that requires no understanding of your site if github turns on PROPFIND and there are dozens of reasons (many good) why they would. If you actually care about the content on that site staying secret you should delete that repo and find a different way to share it.

twodave 6y ago
All the contents of my house are publicly accessible to anyone who wants to break a window--this data is less important than any of that stuff, I just didn't want it sitting out on the curb, so to speak. Edit: I hadn't thought about WEBDAV being an entry point, though--thanks for pointing that out.
- swiley 6y ago
  Automated crawling is way different than physically breaking and entering. One is a (legal!) routine process executed by robots and one is a serious crime that requires will, forethought, and physical presence.
  - twodave 6y ago
    Automated crawlers were not the threat I was trying to guard against--it's more the 40 year old creep looking for pictures of kids on people's blogs and being bold enough to leave disgusting comments that I wanted to get away from--problem solved.