just featured on Solid Academy July 2024 Wordpress Plugin Roundup

[verne-work]

more of a comment/kudo .... SolidWP, formerly called iThemes Security, has a free monthly wordpress plugin roundup

today's webinar featured your plugin !! congrats !!

see https://solidwp.com/academy/ for the an archive of the one hour webinar -- your plugin was the last one presented

[rtpHarry]

Thank you for letting me know, for some reason I did see this notice this until just now!

It's a shame that the demonstrated version didn't have the basic styles applied that come with the plugin, which made it look a bit sloppy. I wonder what happened with it there.

There is nowhere for me to reply to the comments that people made during the live stream, so I'm going to shout into the void in case anyone ends up seeing this.

Comment In Video About The External Encryption Key
Being able to define the encryption key externally is more than just putting it in your wp-config.php.

It means that you can provide it via your preferred method, such as in an .env file or, pulled in from a secrets management service.

Depending on how badly you are exposed, potentially nothing will stop a hacker but it puts the power in your hands to put the standard mitigations in place to severely slow them down.

Comment In Notes In Video About Not Supporting A Passphrase
This is correct for now, but you do have the full power of WordPress at your disposal.

You can put the view password page inside a password protected page, or use other tools to restrict it.

You can do the same with the "create" page and make it only for sending passwords.

13:54:23 From Sue Polinsky to Everyone:
I use it, I don't think I'd want it inside WP
13:55:13 From Billie Carroll to Everyone:
@sue Polinsky. Better as a separate function.
This is how we use it.

We have our business site, then we have a separate WordPress site running on a subdomain, just for the secrets.

The point of making it as a WordPress plugin is that you can use your existing skills to brand the website. With ours, it's branded to the company, but stripped back with no navigation, in a landing page style, just to focus on this one thing, but provide it in a professional / branded way.

And you have the full WP ecosystem of security plugins, and other features to lock it down as you see fit.

It's up to you, what your risk tolerance is, if you put it on your main site. The next section explains why its not a huge risk even if you do, though.

13:55:29 From manu martinez to Everyone:
has it been hacked before
Not yet, but in theory, if it was hacked, it wouldn't be of any use to the hackers - unless the content being shared was being misused.

The point is that you only share the password via tools like this, so if they do get hacked, there is no associated user, and no context for what the password is for. It's just noise.

The only place that it's associated with anything is the chat log / email thread where you share it.

If your email / comms got hacked, then without the tool, the password is in the logs forever.

With the tool, they will just find a "link expired" message when they try to harvest it.

It doesn't 100% protect you, but it does vastly reduce the attack surface.

You can either leave the maximum security level to "the password that your client picked for their email account", and hope they don't get hacked (because you have a secure password on your email, right?) or you can take matters into your own hands with this solution.

13:55:56 From Sue Polinsky to Everyone:
None of our clients would ever remember the secret link.
I think Sue has misunderstood what this tool is.

You would either send them a viewing link with a password, or send them a link requesting they share a password.

There is no scenario that I foresee where they would have to manually remember the password link.

13:56:58 From Verne Britton to Everyone:
how about just a few minutes?
Thanks for opening the issue (#2) for this Verne, it is something that I would consider if users wanted it.

In my experience from dogfooding with it, it's usually the other way around; where they want more time because they didn't read the email for two weeks and now the password has expired! :)

However, adding more features like short expiration, password to view, tap to reveal (blurred text) and "delete now" features are all on the roadmap, if the plugin starts to get any traction.

13:58:35 From Sue Polinsky to Everyone:
I can't imagine an ongoing use case for this on a single site
Not for a normal blog, or a personal site.

I wanted it as a web development agency, and it could be used by marketing companies, etc.

It's for any business that works inside their clients accounts and needs to exchange access details in a way that doesn't hang around forever in email logs or chat logs.

Reference to onetimesecret.com or other tool
I just remembered that part of the reason I wanted to build this was to have it self hosted.

Third party services are convenient but you're asking the client to trust that brand, and they may not understand what security level they provide.

This tool lets them interact with your brand, which they already know and trust.