I'm not done ;-))
------------ Do they pay for this privilege? If so they should be able to save up & buy an SSL cert. Total Security is like the mythical Total Solution which in turn is like Santa & the tooth fairy. Every system has holes. SSL is one very easy way to close one big back door. Have you heard of the 80/20 rule? Security is very similar you don't need the level of security a bank has to run a weblog. Absolute terms like "not ONE" & "ever" are very hard to live up to. ------------ I would like to know where you host the sites of your clients? Do you host them yourself? If so, have you got more than one client on one box? Is your own website hosted with all those clients? If you know about SQL injection than you should also know that access to anyones admin panel will most likely be a HOLE into your DOMAIN, i.e. whoever else is hosted on that server. I once worked with a website that had Auction software running, the admin panel allowed me to include text or files, I did some SQL injection to get the password of other sites that had the same software running uploaded my own CF file and dumped the whole db moved it to a folder on the web and downloaded the file (with the clients permission by the way). If this website was not vulnerable to SQL injection then we would have to resort to Session Hijacking or whatever else, if at that stage there is some concrete security in place and the password cannot be obtained, well then a big hole is protected. ------------ No - you're twisting my words. Most of our admin tools don't use SSL because its not worth the trouble. Why is someone going to break into a flower shops homepage & modify content? And even if they do is it a tragedy having incorrect content on the site for a couple of hours until someone notices & the previous version is restored? Anyway I've said pretty much all I've got to say. Security costs time & money. Security is not always required & is often overkill. SSL (or equivalent) is a prerequisite to any sort of web based security. ------------ Hmmmmmmmmm..... Taco Fleur 07 3535 5072 Blog: http://www.tacofleur.com/index/blog/ Methodology: http://www.tacofleur.com/index/methodology/ Tell me and I will forget Show me and I will remember Teach me and I will learn --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004
