1

I hosting my site on infinityfree.net for free and dokuwiki is installed there.

Couple of my colleagues, including me, are going to use wiki for writing documentation for our project. Wiki is private, and only I can provide new accounts. Also, there is small chance, that I can give temporal read-only access to third party member.

Currently my site working over HTTP, therefore I have tried to use Let’s Encrypt to get ssl certificate, but it's look like, that my host is blocking that service. Also, there is no access to SSH and some PHP methods.

So, should I be worried, that my connection is not secure? Can I rely on "security through obscurity"? Is there are alternative solutions instead of setting up HTTPS (a free one is preferable)?

I concerned to be secured in 3 things

  1. Keep content of wiki out of public sight. Description of technical implementation is top priority and should be available only to few selected people. Other info is not so important.
  2. Keep data from getting removed/corrupted.
  3. Avoid Man-in-the-middle attacks. Though, I don't sure how critical is this vulnerability in my case
Improve this question
1
  • Given the three concerns you have, it's not safe to not use HTTPS. Via HTTP, anyone standing on the way of the traffic could gain login credentials of the accounts with access to the service and then potentially view, modify or delete articles in the wiki.
    – Elhitch
    Commented Aug 15, 2019 at 7:04

1 Answer 1

Reset to default
4

You used "security through obscurity" in quotes, so I don't think I need to convince you that that is not going to work.

To achieve your goals, you will need to encrypt the connection between the clients connecting and the server (with a logon). HTTPS is the simplest, lowest effort, and cheapest way to do that.

But you can also consider things like placing the site behind another technology that is encrypted, like VPNs, or if you like tinkering, you can set up tunnels and proxies.

Or, the best solution appears to be to use a free wiki service that includes logins and HTTPS. There are tons of those.

I'm also going to toss this into the mix as an alternative approach to the whole thing. Try Jekyll and GitHub. You want a wiki that will eventually be published, but you do not want to publish it yet. So, set up a Jekyll site on a private GitHub repo. You all get to work on the wiki together, in complete protection, and when you are done, you can publish the wiki on GitHub Pages. I'm sure there are alternatives to GitHub, but I'm not aware of another that offers this functionality.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .