|
Friday 24 October 2003 9:42:31 am
Lars, there are many weaknesses, not "the" weakness. Most users of eZPublish will not use SSL. This is one reason why it is important for eZPublish to provide good security by default. Another reason is that there are some practical problems with requiring users to use SSL to solve security problems. One problem is that the users have to evaluate the security / speed tradeoffs themselves, but they are not necessarily experts in eZPublish so they won't know the security tradeoffs very well. Another problem is that it is very easy to mess up the installation of SSL in such a way so as to do nothing to aid security, especially if one tries to secure only part of the site (which is exactly what someone would want to do if they wanted to use SSL to address only this vulnerability without incurring performance penalties for the rest of the site). I do agree that it could be helpful to have documentation for users about how to use SSL with their eZPublish sites. In my opinion this documentation is a completely separate issue.
|