<BACAC43696274AE0B2519BDD1E501185@VistaPC> <0A964747-CB46-4405-AED9-C55E40F861B6@automattic.com> <49BE3020.7060806@libero.it> <20090316110513.GG94670@rambler-co.ru> <49BE43C8.7090302@libero.it> <000c01c9a999$b66802d0$23380870$@com> <2dcdbfcc0903201445p73a51e06p1a2303684ba9249f@mail.gmail.com>

> If what you *really* want is a web interface to manage the users, simply
make (or pay someone to make) a web interface to manage the password files.

That is not a viable solution, you know it. Managing sensitive files in a
web environment is very unsecure, through a web interface. Ya, you can
create a htpasswd file into /etc/nginx dir for example and do a chmod
0700/chown nginx on it. Then, it is secure to stick in there your
usernames/passwords. But to use PHP or other language to manipulate
sensitive data through a POST that can get sniffed easy by anyone is simply
insane, IMO. Not to mention that your file has to be editable by anyone in
order to have your script write information into it...



Edited 1 time(s). Last edit at 03/21/2009 11:31AM by Jim Ohlstein.