My system to share private data works like this:

I rent a virtual server at a hosting company.

There I have a self-signed certificate installed.

The folder with the files inside is password protected via htaccess file

AuthType Basic
AuthUserFile /path/.htpasswd
Require valid-user

passwords are salted in htpasswd.

It is for downloading files I uploaded.

So SSL check, Password check.

You enter the url of the file and are prompted to accept the certificate and enter the password and username. If right, you get the file.

Which loopholes do you see I should fix?

1 Answer 1


I rent a virtual server at a hosting company.

You are ultimately trusting this company, as it has unlimited access to all your data. Choose wisely, e.g. put more value to the security and privacy than to the price.

There I have a self-signed certificate installed.

A certificate is only for authentication; it doesn't tell anything about the encryption used for the connection. Use only current TLS versions with recommended strong ciphersuites i.e. TLS 1.2 with RFC 7525, 4.2 or TLS 1.3 with its mandatory ciphersuites from RFC 8446, 9.1.

If others are using your service, consider using e.g. a free Let's Encrypt certificate instead of a self-signed one, as the authentication would then use a public-key infrastructure (PKI) and be automated; if people are supposed to check the certificate manually, they'll just accept any certificate.

  • Isn't Let's encrypt more insecure due to it being public and free as in "If something is free, you are the product"? Apr 9, 2020 at 22:01
  • 2
    No. It's a nonprofit Certificate Authority provided by ISRG, running entirely on donations. No ads and shit. BTW you are asking this question on a public and free Q/A platform, not considering it insecure for the same reasons. Or using Ubuntu & Apache HTTPd. Apr 10, 2020 at 4:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .