<p>Steph,</p>
<p>But what you are suggesting is that security by obscurity is the answer in this case - which is a dangerous path to follow.</p>
<p>It may be easier for someone to break into the CMS than into the BO backend, but once they are into BO then they can do everything you suggested, not only to one site, but to every site on that host.</p>
<p>I don't know how uou run your business, or how the law works in the US, but here in Australia the client is responsible for the security of what they install on their website, and the host is responsible for the security of the server. If a CMS was hacked, I would not be responsible.</p>
<p>Of course the optimal solution would be to use some kind of TLS and intelligent intrusion detection software on both systems which locks access out when it thinks an attack is taking place.</p>
<p>Rashid, I suspect you are correct on saying that BO authentication is probably harder to crack than that of a stock CMS, but the point sound be that yes an attacker can get into one website and cause havoc, but only within that CMS on that specific site. Other sites will be unaffected. I would also hazard a guess that many people are not as vigilant as you or I, and do not frequently change their passwords.</p>
<p>In short, I don't believe security by obscurity is the answer in either case, but I would rather the attacker accessed one site only, and not the server which has access to all.</p>
<p>Regards,</p>
<p>James Darbyshire</p>
<p>Sent from my Samsung Droid™</p>
<p><blockquote type="cite">On 26/09/2010 1:28 AM, "Stephanie Sullivan" <<a href="mailto:ses@aviaweb.com">ses@aviaweb.com</a>> wrote:<br><br>
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">I must not concur. That’s not the worst thing. Picture
this:</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">They break into my client’s zencart, oscommerce or CC
processor integrated cms (as joomla and drupal have plugins/extensions
and I have clients using them). The get into the client’s site and modify
the CC credentials to process using their bogus merchant account. Maybe they
put a hack in to steal their CC numbers. Now you have a security breach that
has big legal implications that you and/or your client have to legally disclose
in the US. You probably have clients screaming at you about bogus charges on
their card. Eventually the site is defaced and their tracks are covered by
wiping most of your database. </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Finally your client’s reputation is damaged/destroyed and
they are angry with you and spread the word they got hacked on your platform damaging
your reputation, etc…</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">I would think it’s far from the worst thing. Of course it
may be worse if you are the client than the hosting company.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> Thanks,</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> -Stephanie</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt">From:</span></b><span style="font-size:10.0pt">
<a href="mailto:blueonyx-bounces@blueonyx.it" target="_blank">blueonyx-bounces@blueonyx.it</a> [mailto:<a href="mailto:blueonyx-bounces@blueonyx.it" target="_blank">blueonyx-bounces@blueonyx.it</a>] <b>On Behalf
Of </b>James Darbyshire<br>
<b>Sent:</b> Saturday, September 25, 2010 10:30 AM<p><font color="#500050"><br>To: BlueOnyx General Mailing List</font></p><b>Subject:</b> [BlueOnyx:05461] Re: Dealing with /admin URL 'hijacking</span></p>
</div>
</div><p><font color="#500050"><br><br> <br><br>I disagree. Certainly it is not best practise for any admin functions to be accessible through ...</font></p></div>
</div>
</div>
<br>_______________________________________________<br>
Blueonyx mailing list<br>
<a href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</a><br>
<a href="http://www.blueonyx.it/mailman/listinfo/blueonyx" target="_blank">http://www.blueonyx.it/mailman/listinfo/blueonyx</a><br>
<br></blockquote></p>