Re: SECURING YOUR ADMIN

This message was sent from: Suggestions and Proposals
http://forums.oscommerce.com/viewtopic.php?p=227933#227933
----------------------------------------------------------------

[quote="Demented"]With any server you should be able to go in and setup .htaccess so that you have to provide a login and passowrd for the admin directory. Also you can add the mod that requires a login and password on top of that if you want more security. This should be good enough to lock down your data. My admin has never run in ssl even with my shared certificut setup properly. The .htaccess makes your admin directory and you can set the same thing up for other directories in admin as well.[/quote]

Of course this works -- but it's not what I'm worried about.  If you run in a shared environment, there may be hackers running "smart" packet sniffers.  All they have to do is look at the plain text in the packets and search for "password" in the packet & they can get the passwords to your transaction gateway.  HTTPS prevents this.  Besides, once a packet leaves your client or server, you have no way of knowing if the packet is getting sniffed or not.  The WWW is a shared/open environment.

The greatest vulnerability is in the database backup & restore.  Without a working https connection hackers can potentialy grab customer credit info.

You may not have realized that the .htaccess method of protecting your data doesn't encrypt data as it passes between the client & server.  HTTPS does.