2014
-
Security, Legal Bypass, Warrants, and Apple
Sept 21
Apple has announced they won’t be unlocking iOS 8 phones in response to warrants, not as a point of policy, but because the system they’ve built won’t allow it.
-
WordPress Core Proposal: Session Management
Aug 6
When you log in to WordPress, the platform should record the event, where it occurred from, and the device that was used. This would empower you to kill off rogue sessions if necessary.
-
Surprising Search Results
Jun 6
I found out that my top referrer so far this week is the search result page for “decrypt wordpress password hash online.” What’s going on?
-
WordPress and Password Hashing
Apr 21
WordPress’ password creation/verification system is pluggable (meaning you can replace it with your own implementation). Before you do so, though, you should understand what’s already implemented and why.
-
Why Showing The WordPress Username Is A Security Risk
Apr 4
There have been a handful of discussions lately surrounding WordPress and usernames – particularly whether or not exposing usernames is a security risk. The consensus appears to be “no.” I beg to differ.
-
WordPress Core Proposal: SUDO
Jan 8
Logging in to your WordPress site as an administrator when your plan is just to write is a bad idea. The admin user should be for administration and you should use an editor-level user for writing. But this dual-login workflow can be needlessly complicated on many sites. Instead, I propose we introduce a SUDO mode…
-
Securing XML-RPC for WordPress
Jan 1
If you use WordPress, you’ve probably used one of the mobile apps for it. If you’ve used one of these mobile apps, then you’ve used XML-RPC. If you’ve used XML-RPC, then you’ve sent your username and password – in plain text – across the Internet. This is hugely unsafe, and I want to work to…