WordPress Core Proposal: Session Management
·
When you log in to WordPress, the platform should record the event, where it occurred from, and the device that was used. This would empower you to kill off rogue sessions if necessary.
security
-
-
They Should’ve Built it Better
·
Once I mastered the skill of lock-picking, it changed the way I looked at the world. Locked doors that used to obstruct me became mere annoyances. It was a bit of a dangerous revelation.
-
Device Security
·
How much control are we really giving up to anonymous developers with access to an update hook? How secure are our machines?
-
Physical Security
·
All of the encryption software in the world is meaningless if you fail to practice a couple of simple habits regarding physical security.
-
Self-Hosted VPN
·
I’m a stickler for security, so how can I in good conscience connect to a network I don’t trust?
-
Surprising Search Results
·
I found out that my top referrer so far this week is the search result page for “decrypt wordpress password hash online.” What’s going on?
-
Remote and Secure
·
A “virtual private network” is a way to keep your data secure, whether your on a dedicated 4G tether or connected to Starbuck’s free wireless. Traffic from your machine is encrypted at the machine, sent to a remote (trusted) server, decrypted, and proxied to the real network target.
-
WordPress and Password Hashing
·
WordPress’ password creation/verification system is pluggable (meaning you can replace it with your own implementation). Before you do so, though, you should understand what’s already implemented and why.
-
Responsible Disclosure
·
For all the damage Heartbleed did on its own, disclosing the issue the way it was did far more good than harm.
-
Why Showing The WordPress Username Is A Security Risk
·
There have been a handful of discussions lately surrounding WordPress and usernames – particularly whether or not exposing usernames is a security risk. The consensus appears to be “no.” I beg to differ.