4 ms·
I wouldn't say insanely secure. http://blog.trendmicro.com/2010s-most-dangerous-list/ http://blog.trendmicro.com/2010s-most-dangerous-list/ Keeping your WP ins
by newman314 15y ago
I wouldn't say insanely secure. http://blog.trendmicro.com/2010s-most-dangerous-list/ http://blog.trendmicro.com/2010s-most-dangerous-list/
Keeping your WP install up to date is going to go a long way in helping secure things.
Second, the comment about using StartSSL instead of a self-signed cert.
Also, make sure you are using a sane config of ciphers. I've seen too many site where SSL is set up but the cipher list is set to the most insecure possible due to lack of configuration. It's not that hard and actually makes the use of SSL usable.
- tptacek 15y agoThe cipher list is a good point, but know that this is a sev:low vulnerability; attackers aren't generally busting out brute forcers even for the 40-bit export ciphers.
- newman314 15y agoAgreed but I have found customers with TLS_DH_anon_WITH_RC4_128_MD5 enabled for example. =( It's much more likely for a vulnerability with WP code than with cipher but I just wanted to point out the importance of properly setting ciphers. Besides with AES-NI avail, it's much less CPU intensive so another win.
- tptacek 15y agoThat ciphersuite has no viable attacks. Many sites switched to RC4 recently to deal with browser susceptibility to CBC repeated-IV problems.