How to prevent hacking.

How do people protect their username and password when logging in to the manager?

Do you have SSL certificates for all your sites?

Or do people just keep their fingers crossed and hope for the best !?

Mike

From the lack of response I can only assume that either:

1) people have good security but haven't the time to reply to the post

2) the main security measure is fingers crossed !!

I hope it's 1 !

I guess the risks are related to how easy it is for a hacker to get sniffing software onto the internet. I don't know how easy that is.

I think it is a lot easier to sniff traffic on wifi connections. So it's probably wise not to use un-ssl-ed manager connections on wifi, especially public wifi such as cafes.

I'm interested to hear some views on this too. I assume SSL for the manager would be a recommendation, I imagine this would make for a fairly solid solution.

I think it is a lot easier to sniff traffic on wifi connections. So it's probably wise not to use un-ssl-ed manager connections on wifi, especially public wifi such as cafes.

I use public wifi quite a lot; if you're on a mac, OpenDNS have released DNSCypt which encrypts DNS traffic even if you're not on an ssl connection...

Quote from: okyanet at Feb 03, 2012, 06:54 AM

I use public wifi quite a lot; if you're on a mac, OpenDNS have released DNSCypt which encrypts DNS traffic even if you're not on an ssl connection...

Thanks, that looks interesting ....

So will it encrypt your manager username and password too?

The website says "SSL turns HTTP web traffic into HTTPS encrypted Web traffic, DNSCrypt turns regular DNS traffic into encrypted DNS "

I don't know what the difference is, will the HTTP traffic be a subset of DNS traffic and so get encrypted by DNSCrypt ?

I think I got a bit ahead of myself there - I'd thought that might be the case but it doesn't appear to be a replacement for SSL, rather it encrypts your DNS lookup if you already use OpenDNS. So while a sniffer might not know exactly where you are logging into, the data you are sending won't be encrypted and would still be easily intercepted, including your username and password.

So perhaps using SSL or a VPN would be the way to go...

How could a VPN protect your manager username and password? I can see that it might improve security on the server side compared to a shared host but does it offer a secure login for the manager?