Improving WordPress Password Security
roots.io
roots.io
1. Too many WP users are still on old versions like 5.2 and 5.3 2. They don’t care about new "features""
If you really do power 20%+ of the websites out there, do you not perhaps have enough influence to influence a change? I could almost buy this reasoning 6-7 years ago. "If we start requiring PHP 5.1... all our users might flock to something else that still only needs 4.3! We better not push things too much".
A large segment of the hosting world caters to the wordpress user (casual and professional) and they will jump to whatever requirements Wordpress puts out. Where are they going to go? No one will want to upset this golden goose. WP, make version 5.0 require PHP 7 and be done with it. People will upgrade. They have no real choice - you've killed most any platform that might be a serious competitor for the next several years.
I can't agree enough though, WP can be a huge driving force in making all hosting providers utilize modern versions of PHP. However, instead of using that weight to make a difference, they're completely content to hold PHP back. All at the expense and detriment of the user, in the name of the user.
Having sites hacked due to old version of PHP is an inconvenience.
Why not just tell everyone to chmod 777 the entire website too, just so they're not inconvenienced?
Tongue-in-cheek, of course, but there's a balance to be struck between convenience and security, and I think they're somewhat on the wrong side.
I was really mixed on the 'auto-update' wordpress core stuff. While I get it - it keeps some people up to date - it also means my system needs to be left in a state where software can be altered, and that means it can be maliciously altered too.
The "moving to a new version when they don't know the language" argument - I don't buy it. Almost everyone I know who has wordpress installed who is not a techie has a host that manages it, or presses a button on a control panel. Pressing another button, or having the host do some more stuff - neither of these are inconveniences that outweigh the security benefits - not just to that site owner, but the rest of the internet.
Why not just tell everyone to chmod 777 the entire website
Now WordPress does actually work with a lot of the top hosting companies to get their PHP versions upgraded. They do this quietly but they do talk about it from time to time. But they don't go nearly far enough with this outreach program and by still allowing 5.2 and not setting any deprecation timelines it really hurts their efforts.
Upgrading PHP isn't just about using "new features" - WP doesn't even have to use any new stuff, but still require higher versions for security and speed benefits would help move the web forward a lot.
I think it's worse to think you're up to date because your Wordpress install is up to date, but you are hashing with md5 and using php 5.2.
The only realistic solution would be for hosts to forcibly upgrade customers' sites, which causes significant breakage (even < 1% is thousands and thousands of sites). Is that acceptable? Who's job is it to fix that? Are hosts expected to just eat the churn from customers cancelling?
I'm not agreeing or disagreeing, just sharing the reality of the situation.
They could stop putting new customers on outdated systems, for a start. I routinely still see shared hosting delivering PHP 5.4, in 2015 (last I saw something that jarring).
You want to keep people on old stuff? Quanrantine them, and have all new customers going forward on newer stuff, and develop a plan for upgrading. "Guys, yes, you want to keep running PHP 5.3, but for the security of the entire data center, we have to upgrade. You may need to upgrade your wordpress/etc - we'll do what we can to help mitigate problems, but not addressing this means your site is more at risk of becoming hacked".
They would probably see a 10x improvement on contributions by moving to github/gitlab almost overnight, potentially fixing these stupid issues.
As mgkimsal said, they should also take a hard stance and require PHP 7 for version 5.0. The speed improvements alone would be worth it.
Those of us who have to clean up after it, and those of us who've had to deal with spam and malware-infested wordpress sites interfering with our business.
Much like google/gmail, windows, and other large monopoly-like players, wordpress is a huge impact on a lot of businesses; whether those businesses are using wordpress or not, we still feel the impact (and yes, I am using it for a couple projects as well - chmod 400 on pretty much the whole site unless I'm doing updates).
This is ignoring the fact that distributions provide security updates for older versions. Looks like RHEL5 includes PHP 5.1 and it's possible to get support for it until 2020.
I work for a shared hoster, we host a ton of WordPress sites.
The problem here is that in shared hosting world MySQL is ubiquitous, along with PHP. It's all you need to get your WordPress blog up and running. Adding a dependency on a NoSQL datastore breaks that simplicity. Also which NoSQL database do you target because not all of them are suitable for running in these types of environments.
Also wp_options is, as the table name suggests, mostly just option settings which are looked up by a known key "option_name" then the json-like blob is read from the "option_value" field and parsed. There's very little or no searching done for values inside that blob so you're adding NoSQL complexity just to store key/value pairs. MySQL is a well known, well understood thing and "just works" for apps like WordPress.
A lot of people praise WordPress for the great number of plugins and themes, but the reality is that only 1% of those are quality code, forward-compatible, following best practices, secure, and suitable for use and not just getting something out of the door quickly. That's why WordPress needs rethinking and most importantly - some sandboxing of themes at least because you can't even allow a shared hosting to upload custom themes as most of them can hack your entire infrastructure being plain PHP code.
I can't believe WordPress being such an archaic product, why they don't support Smarty-based themes, which could be execution-safe.
What the heck took them so long?
Correct me if I'm wrong, but aren't there organisations being prosecuted in some jurisdictions for having password security that weak?
Just skimmed the WP ticket, what a horrible amount of effort to cover an edge case of people regressing to a 4 years past dead PHP version.
I moved away from Wordpress years ago, but it's always great to see the community pushing to make everything more secure.