moved readme/security to wiki
Massimo Melina committed
Sep 30, 2024 at 22:25 UTC
4e0c311056466fa5fea9302d10c14e15ade0327f
1 file changed
-27
README.md
-27
@@ -119,33 +119,6 @@ In the Languages section of the Admin-panel you can install additional language
119
120
If your language is missing, please consider [translating yourself](https://github.com/rejetto/hfs/wiki/Translation).
121
122
-## Why you should upgrade from HFS 2.x
123
-
124
-HFS 2.x is vulnerable to important attacks, and there is no known solution at the moment.
125
-
126
-As you can see from the list of features, we already have some goods that you cannot find in HFS 2.
127
-Other than that, you can also consider:
128
-
129
-- it's more robust: it was designed to be an always-running server, while HFS 1-2 was designed for occasional usage (transfer and quit)
130
-- passwords are never really stored, just a non-reversible hash is
131
-- faster search
132
-- more flexible permissions
133
-
134
-## Security
135
-
136
-While this project focuses on ease of use, we care about security.
137
-- HTTPS support
138
-- Passwords are not saved, and not disclosed even without https thanks to [SRP](https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)
139
-- Automated tests ran on every release, including libraries audit
140
-- No default admin password
141
-
142
-Some actions you can take for improved security:
143
-- use https, better if using a proper certificate, even free with [Letsencrypt](https://letsencrypt.org/).
144
-- have a domain (ddns is ok too), configure it in "Internet" page, and enable "Accept requests only using domain"
145
-- install "antidos" plugin
146
-- ensure "antibrute" plugin is running
147
-- disable "unprotected admin on localhost"
148
-
122
## Hidden features
123
124
- Appending `#LOGIN` to address will bring up the login dialog