Hey guys, i'm a web developer and i'm currently working

Question

Hey guys, i'm a web developer and i'm currently working

on a pure PHP script that acts like a file manager / analizer for servers, and have access to the complete file system of the server where is installed; So, for such reason i made a "security key", basically a javascript auth function executed with Tampermonkey ( a browser extension), and the script will work only if the key is present

But i was thinking that maybe someone on the staff of the IT of a company or a sys-admin on a college that uses my script may want to use the app in a computer that doesn't have the "key" installed, so my question is:

Its a good idea to implement a master password to unlock the script withouth the key?

NOTE: is important to say the authentication process and all the AES decryption keys are contained in the "key", programmed to run from the Tampermonkey extension, and this information is totally isolated from the main php file of the utility, so no cookies or login information will be saved on the server or the local storage of the browser

0

01.07.2020

1 ответов

13 просмотров

Ahmard · Accepted Answer

Ahmard

It depends on the type of script you are developing. If its open source, then the best idea i think is to not provide master key, as it may fell into wrong hand. If its private, then its your choice. Filesystem is the last place that anyone hacker will want have access to. Just consider the risks.

0

01.07.2020

Похожие чаты

Hey guys, i'm a web developer and i'm currently working

1 ответов

Похожие вопросы