• Resolved David 9

    (@davidhamilton)


    Hi,

    I just came across this security vulnerability and was shocked to find that it has been known about for sometime but seemingly not addressed in the wordpress updates. Is there a reason for this?

    Clicking on the author name to show the author archives will display the username of the author in the URL no matter what Nickname they have entered. This allows a hacker to get the first part of the puzzle and only have to guess a password. I see this as a massive flaw and have found it on numerous wordpress websites.

    The following link shows how this can be fixed, but the reality is that many using wordpress won’t even be aware that this vulnerability exists. I’m suggesting that this be patched.

    http://itpixie.com/2012/10/hide-your-wordpress-login-from-author-archive/

Viewing 8 replies - 1 through 8 (of 8 total)
  • Thread Starter David 9

    (@davidhamilton)

    Or is this actually a fault in some themes displaying the username rather than the Nickname in the URL?

    This has already been discussed many, many, times. To summarise, the strength of your login lies in your password – not your username. But if this continues to bother you, try installing http://wordpress.org/plugins/hide-username-front-side/

    Thread Starter David 9

    (@davidhamilton)

    Thanks for the link to the plugin esmi. It seems that this problem can also be corrected in a theme’s functions.php file, though I’ve yet to try the code below.

    http://www.osmialowski.co.uk/change-author-archive-url-in-wordpress/

    Do you think that it is ‘best practice’ to openly display usernames on a website? I thought the reason that wordpress introduced the Nickname option was for the very reason to keep usernames off the website. It seems that some theme builders are not taking advantage of this – it should be a requirement in my opinion.

    This is part of WordPress core. The theme is doing nothing wrong.

    Thread Starter David 9

    (@davidhamilton)

    Is the official position of wordpress that it is best practice to display usernames publicly on a website?

    I don’t think so – why would they have created the Nickname option if it was? The same reason they used to insert the Nickname as a feature has to be carried on to it’s logical conclusion and usernames prevented from appearing in the author archive url. So that’s why I’m asking that it be a feature request.

    If they don’t do anything about it, then it’s up to the developers of themes to easily code for in their functions.php file.

    Is the official position of wordpress that it is best practice to display usernames publicly on a website?

    At present, yes – the strength of your login lies in your password – not your username.

    why would they have created the Nickname option if it was?

    So people can have a displayed name that is different from their username if they want to.

    The same reason they used to insert the Nickname as a feature has to be carried on to it’s logical conclusion and usernames prevented from appearing in the author archive url.

    I’m sorry but you are incorrect.

    Thread Starter David 9

    (@davidhamilton)

    Yes, you are correct, I found an article on WP Tavern explaining why this is wordpress’ official position. For anyone else following the conversation this article has a good discussion at the end of it.

    http://wptavern.com/why-showing-the-wordpress-username-is-not-a-security-risk

    The Nickname option purpose seems not to be to hide the username, but rather to display the user’s name in a more ascetically pleasing way.
    However, I think I will be including a warning to people who sign up as authors on my site to make sure their usernames are not anything embarrassing as they can still be publicly seen.

    Thanks for the help esmi and bearing with me!

    No problem 🙂

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Author archive revealing username should be fixed’ is closed to new replies.