Credentials in repo about dgca-issuance-web

[lennybacon]

Just. Remove. It.

[0ki]

Whatever you do, don't simply remove this. What do you think would happen if software without the .htpasswd is installed by someone who clearly doesn't care about security?

Replace the hash with non-reversible entry, so that installer is forced to change it, provide instructions for changing it.

[PLTorrent]

They would become very real if you put them (or not remove) in your config on production... and such things happen...

[carminedigre]

A good challenge will be to revoke that 'fake certificates'

[MaksymSharinDev]

i am a memer and here we have something that made history

Directed.by.Robert.B.Weide.-.Clip.mp4

[owlstead]

I would also suggest that if any kind of credentials are shown for demo purposes they would use bcrypt with a high(er) iteration count instead of the old Apache APR1 password hash. That's not a very secure password hash (48 bit salt, 1000 iterations of MD5 - a thousand iterations takes no time at all on modern computers). Of course, the security of the used passwords or pass phrases is even more important.

[m-terlinde]

Just. Remove. It.

Yes, of cause. But there could be more values, which need changing.

[0ki]

Aren't those demo credentials, @jurosens ?

[m-terlinde]

Maybe there should be a documentation, which values should be changed before going to production.

[dennisbrouwer91]

@jurosens Ping!

[tommasogiannoni]

It was fixed ?

[gboddin]

Whatever you do, don't simply remove this. What do you think would happen if software without the .htpasswd is installed by someone who clearly doesn't care about security?

Replace the hash with non-reversible entry, so that installer is forced to change it, provide instructions for changing it.

Better, expect a password to be set in the image config
If it isn't generate a random one, they will HAVE to change it.