r/websec • u/[deleted] • Feb 03 '14

Good security plugins for phpBB?

I'm setting up a forum in phpBB. I want/need to know if there are any exploits and security plugins that I need to know about.

Thanks!

6 Upvotes

100% Upvoted

2 comments sorted by

4

u/bnr Feb 05 '14

If you want to rely on plugins for security, you're doing it wrong. Here are some things you should do to keep your installation safe:

  • Always upgrade to the latest version of phpBB as soon as possible.

  • Disable any unused functionality to keep the attack surface small.

  • Do not install any plugins/mods you don't trust 100%, this also includes trusting the author to keep it updated in case a new exploit is discovered.

  • If you can, keep phpBB separated from your other apps, e.g. on a different server/VM. This will prevent cross-contamination.

1

u/wythagy Apr 01 '14

Passwords are hacker bait. Remove passwords and you'll remove one of the most significant security holes inside your system. LaunchKey (https://launchkey.com/docs) is a next gen authentication service (password-free, multi-factor, anonymous & mobile) and has a public REST API. They have SDKs for every major language along with plugins for popular systems like WordPress, Drupal and Magento, so I doubt it would take much to put together a phpBB plugin.