password security

Post your Click counter digestion problems here
Post Reply
Junkyard-Kid
Posts: 2
Joined: Wed Jan 17, 2018 6:12 pm

password security

Post by Junkyard-Kid »

Script URL: Don't understand
Version of script: 2.1.2
Hosting company: godaddy
URL of phpinfo.php: Don't understand
URL of session_test.php: Don't understand
What terms did you try when SEARCHING for a solution: "password"
--------------------------------------------

Greetings everybody :D
This is my first time on the forum, having just installed 'click counter'.

I found the instructions very clear - I was able to get everything set up (and working) very easily.
I apologise for not knowing the answers to the URL questions - I'm new to php.

I'm trying to become security concious.
It's not easy, because everything techie seems to default to unsecure :?

I noticed that my cPanel has an option 'no indexing', to prevent my directory contents from being displayed if an index.html or php is not present.
I read somewhere that this might impact on doc delivery speed.
Does anybody have any knowledge of this?

Otherwise, it seems sensible to switch it to 'no indexing'.

Anyway, I then examined the contents of ccount and found the password is in ccount_settings.php which is in my public_html directory.
I tried to access it directly but the page showed "invalid attempt!".

Even still; I was wondering whether this can be downloaded by other means, by people who know their way around servers.
What is the thinking on this?

If it is not very secure; perhaps a warning should be provided (during installation) to use a unique password - I've seen such warnings from time to time.

Is it a difficult task to scramble the password?

Regarding display.php & display(after-install).php
Should both these files be deleted?

Anyway, so far, so good.
I'm now going to rewrite all the links in my docs :)

Edit
That done, I've noticed that my browser firefox, on my site, always creates unique clicks.
I did a search here, and learned that it must be a cookie problem.

Tested chrome and it's the same.
I tried disabling ublock, but it made no difference.

Perhaps it is the case that some visitors will always show up as unique.
______________________________________________________
We always like clear instructions, and if possible 'a demo'
A good reference might be PHP Junkyard ;)
Klemen
Site Admin
Posts: 10116
Joined: Fri Feb 11, 2005 4:04 pm

Re: password security

Post by Klemen »

Hi,

Preventing directory contents from being displayed if an index.html or php is not present should always be ON (so contents hidden if there is no index file), unless you have a very specific requirement for that to be turned off (if you don't know - you don't have it).

Note that the purpose of this forum is not general security discussion, you should consult Google or other communities for general security related questions.

If someone can download the settings file from your server he already has control over your server - knowing the password would make no difference then. Using unique passwords for each applications/service is general security good practice; again, consult Google for more.

Deleting "display.php" is recommended if you don't plan to show link statistics publicly, as suggested on the "Instructions" page in CCount admin panel.

Unique clicks are indeed determined by cookies. If that is not working properly, something is blocking cookies (on our PC). Could be security softare, browser private mode etc...
Klemen, creator of HESK and PHPJunkyardWas this helpful? You can buy me a drink here Image

Image You should follow me on Twitter here

Help desk software | Cloud help desk | Guestbook | Link manager | Click counter | more PHP Scripts ...

Also browse for php hosting companies, read php books, find php resources and use webmaster tools
Junkyard-Kid
Posts: 2
Joined: Wed Jan 17, 2018 6:12 pm

Re: password security

Post by Junkyard-Kid »

Hi Klemen,
Thanks for taking the time to reply.
I have noted what you said :)
______________________________________________________
We always like clear instructions, and if possible 'a demo'
A good reference might be PHP Junkyard ;)
Post Reply