Textpattern Support Forum

artagesw wrote:

The difference is that your bank is securing that page with SSL, and you are likely not doing the same with your Txp site. Therefore, your user name and password are sent in the clear every time you log in, and can be intercepted by anyone who might be listening.

“Anyone who might be listening”… that requires access to a router on the path from your computer to the server where TXP is installed. Sure, it’s possible, but a bank is typically a more interesting target than the average TXP install. POP3 also works with plain text authentication, but you rarely hear about intercepted user/pass there.

I think the risk of a dictionary attack on weak user/pass combinations is greater than someone being able to sniff the user/pass due to the use of a non-secure connection. And using SSL doesn’t prevent a keylogger from grabbing the username/password when you enter it on your own computer nor does it protect users from phishing attacks.

Last edited by ruud (2008-11-04 10:39:05)

How could you have textpattern at admin.domain.com/ but your site at domain.com/ ?

It’s fairly possible, ‘cause it’s just subdomain. Just conf it to read textpattern’s admin dir.

driz wrote:

So what’s going where filewise?

It really depends on how your host handles sub domains. Mine will let me easily point my subdomain to ANY directory which would make this easy. It would then just be a matter of blocking access from the other domain.

driz wrote:

Hey artagesw How could you have textpattern at admin.domain.com/ but your site at domain.com/ ?

My method requires a few changes to the core code, so it is a bit involved. (My mods also allow for multi-site support from a single txp install.) I’m talking with the txp devs about whether it would make sense to incorporate these changes into txp core, which would make it a much simpler process.

Meantime, as others have noted, if your host supports subdomain pointing then that would be the easiest way to go (along with a mod_rewrite or similar rule to block direct access to the /textpattern directory).