3 ms·

Let's listen to security advice from the person who thinks obscurity means anything. :-)

by jdub 12y ago

falcolas 12y ago
Obscurity gains you many things. It gains you protection from non-targeted attacks. Sure, for Wired this means less, but if you're not Wired, moving your SSH port will reduce the number of drive-by attacks made against SSH. Removing the version from your headers will reduce the number of "use Google to find vulnerable wordpress versions", and require an attacker to expend significantly more resources to identify vulnerabilities in your site. Obscurity means you only have to worry about being directly targeted, not randomly targeted. It certainly won't make you secure, but neither does it reduce your security, either.
aikah 12y ago
> Let's listen to security advice from the person who thinks obscurity means anything. :-) People shouldn't publish their login credentials on the net.That's security by obscurity. If you think of an alternative to that,let me know. Security is a matter of layers. The more layers you add, the more secure it gets. A smart thing to do is not to choose site.com/wp-admin.php as an admin URL accessible all over the net. Unfortunatly WP makes it very hard not to do that. Using WP is bad for small businesses that think WP makes webdev easy,because it tends to promote non secure habits for the sake of easy installation and use. WP is bad for big businesses because it's an serious attack vector. WP is good for security consultants on the other hand that make quite a lot of money fixing all WP security flaws,basically rewriting a good chunk of the CMS.
- mikeschinkel 12y ago
  > WP is bad for big businesses because it's an serious attack vector. That's FUD. WordPress is not hard to secure if you follow some best practices and do not use crap plugins. That said, one would hope with the projects budgets that big businesses offer to agencies that agencies would hire competent people to build their sites. Full disclosure: that's what we do; build WP sites for agencies on behalf their big business clients.

Let's listen to security advice from the person who thinks obscurity means anything. :-)

by jdub 12y ago

Let's listen to security advice from the person who thinks obscurity means anything. :-)

Obscurity gains you many things. It gains you protection from non-targeted attacks. Sure, for Wired this means less, but if you're not Wired, moving your SSH port will reduce the number of drive-by attacks made against SSH. Removing the version from your headers will reduce the number of "use Google to find vulnerable wordpress versions", and require an attacker to expend significantly more resources to identify vulnerabilities in your site. Obscurity means you only have to worry about being directly targeted, not randomly targeted. It certainly won't make you secure, but neither does it reduce your security, either.

aikah 12y ago

> Let's listen to security advice from the person who thinks obscurity means anything. :-) People shouldn't publish their login credentials on the net.That's security by obscurity. If you think of an alternative to that,let me know. Security is a matter of layers. The more layers you add, the more secure it gets. A smart thing to do is not to choose site.com/wp-admin.php as an admin URL accessible all over the net. Unfortunatly WP makes it very hard not to do that. Using WP is bad for small businesses that think WP makes webdev easy,because it tends to promote non secure habits for the sake of easy installation and use. WP is bad for big businesses because it's an serious attack vector. WP is good for security consultants on the other hand that make quite a lot of money fixing all WP security flaws,basically rewriting a good chunk of the CMS.

mikeschinkel 12y ago
> WP is bad for big businesses because it's an serious attack vector. That's FUD. WordPress is not hard to secure if you follow some best practices and do not use crap plugins. That said, one would hope with the projects budgets that big businesses offer to agencies that agencies would hire competent people to build their sites. Full disclosure: that's what we do; build WP sites for agencies on behalf their big business clients.