<!doctype html public "-//W3C//DTD W3 HTML//EN">
<html><head><style type="text/css"><!--
blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 }
--></style><title>Re: [OpenID] allowing users to switch to
opendid-only: poi</title></head><body>
<div>>We will be using <a href="http://mediatemple.net/">Media
Temple</a> to host the site and my co-designer believes that they are
an indominatable Fort Knox when it comes to keeping date secure.</div>
<div><br></div>
<div>Physically, sure. Their data center is well-protected. But to the
webserver? At most they might automatically update you with the latest
security fixes (which you can do yourself), that doesn't do anything
to protect you against a poorly-written website. They might have a
network IDS keeping an eye on traffic, but what good is that when SSL
(you *are* using SSL for login attempts, aren't you? y'know, not
letting customers send usernames and passwords across "in the
clear"?) prevents their IDS from perceiving that a user is making
multiple consecutive login attempts?</div>
<div><br></div>
<div>So you stop using SSL, and the IDS has to decide when it crosses
over from seeing an innocent user who forgot their password to an
attacker trying to guess a password. Is it using its own definitions
or some you supplied?</div>
<div><br></div>
<div>Try contacting Media Temple directly and asking their techs to
run down a list of the dangers for you. Your co-designer might accept
that Media Temple can't achieve miracles when it comes straight from
them.</div>
<div><br></div>
<div>-Shade</div>
</body>
</html>