Re: Lack of SSL for Debian Wiki login (was: Re: wiki.debian.org password reset)

2013-01-06 Thread Luca Filipozzi
On Sun, Jan 06, 2013 at 07:08:08PM -0500, Jeremy L. Gaddis wrote: * Luca Filipozzi lfili...@debian.org wrote: Please recall our recent email regarding the moinmoin [1] vulnerability [2] and the penetration of Debian's wiki [3]. We have reset all password hashes and sent individual

Re: Lack of SSL for Debian Wiki login (was: Re: wiki.debian.org password reset)

2013-01-06 Thread Charles Plessy
Le Mon, Jan 07, 2013 at 01:41:49AM +, Luca Filipozzi a écrit : OTOH, I'd argue that if one wishes to maintain content at wiki.debian.org, then one should understand the basics of PKI. What do you think? Hi Luca, how about Debian Single Sign On (https://sso.debian.org) ? Have a nice

Re: Lack of SSL for Debian Wiki login (was: Re: wiki.debian.org password reset)

2013-01-06 Thread Jeremy L. Gaddis
* Luca Filipozzi lfili...@debian.org wrote: On Sun, Jan 06, 2013 at 07:08:08PM -0500, Jeremy L. Gaddis wrote: Thanks, I just reset the password on my account only to realize that SSL is not being used by default on wiki.d.o. Yes. :/ Surely this will be fixed in the very near future?

Re: Lack of SSL for Debian Wiki login (was: Re: wiki.debian.org password reset)

2013-01-06 Thread Jeremy L. Gaddis
* Charles Plessy ple...@debian.org wrote: Le Mon, Jan 07, 2013 at 01:41:49AM +, Luca Filipozzi a écrit : OTOH, I'd argue that if one wishes to maintain content at wiki.debian.org, then one should understand the basics of PKI. What do you think? how about Debian Single Sign On

Re: Lack of SSL for Debian Wiki login (was: Re: wiki.debian.org password reset)

2013-01-06 Thread Paul Wise
On Mon, Jan 7, 2013 at 8:08 AM, Jeremy L. Gaddis wrote: Thanks, I just reset the password on my account only to realize that SSL is not being used by default on wiki.d.o. As you found out, there is SSL available but not enforced. I strongly suggest installing xul-ext-https-everywhere and

Re: Lack of SSL for Debian Wiki login (was: Re: wiki.debian.org password reset)

2013-01-06 Thread Paul Wise
On Mon, Jan 7, 2013 at 9:41 AM, Luca Filipozzi wrote: OTOH, I'd argue that if one wishes to maintain content at wiki.debian.org, then one should understand the basics of PKI. What do you think? Many of the Debian wiki editors are there to translate content to their own language. Some of