Fancybox WordPress plugin reveals zero day affecting thousands

Re: The same principle applies as to services

While this is generally true, a lightbox plugin is simple enough that most people would assume it was perfectly safe, plus many clients want a lightbox of some kind so something like this becomes a necessity

Re: The same principle applies as to services

While this is good advice, from what I have seen of WordPress sites in companies, the general life cycle is:

1. Install it for urgent requirement X. As the requirement is urgent, typically the hosting will be done via a third-party with management systems outside of IT's control.

2. Use it for a few months

3. Forget about it until it is compromised. As a corporate domain name was used, site is traced back to company and someone is notified.

4. Panic.

5. Fix issues and discuss shutting site down or bringing in-house but don't take any further action.

6. Got to 3.

@ Hans 1

I appreciate the instructions for users of WP - great job ... one thing I do not understand is the relationship between RFC's and backdoors ... there is none.

Where did RFCs come into the discussion?

There seems to be a general concern with the data slurping ways of Google that makes anything they bring out "for free" a target for suspicion. In this case, an established RFC defines how the thing ought to work, meaning that people with competence can go over the code and spot if weird stuff is happening. As we know from some recent nasties in Open Source, that doesn't always happen but at least the potential is there.

Having said that, it would not really matter unless Google also managed to acquire the actual static site password, which you need in addition to the OTP. The only way that could be grabbed would be through interfering with the admin resources to capture it in cleartext when a new one is entered - the database only stores the hash value so that would be of no use (you'll discover that if you ever have to reset the site admin password with phpAdmin). However, the plugins on the server end are not by Google (and, as far as I can tell, don't reach that deep), so you can put paranoia to rest for a bit..

In general, I rather like OTP. It's stupidly simple to implement (in Joomla it appears to be even part of the main code), it's very easy to use and it just works. Given that it costs nothing it seems a good thing to implement - I wished that wordpress.com added it as well (maybe it actually has, haven't been there for a while).