php-apache-postgres-security / need opinions

justinb

posrgres apache and php sercurity / feedback please

Hello,
My service provider has a postgres database, And i want to redo my website with php and allow my clients to login with sessions and go to their page ( i am a graphic designer/ web developer, clients can log in to download stuff like their business cards , logo's, ect ). The service provider is telling me that if I am allowing my clints to login (login and pass in table in database) that their is a huge security breach, and he can be hacked. He says the only way to do it is with ssl and that I have to buy some sort of ticket/pass/something to get it.

I am of the opinion that

a. he doesn't know what he's talking about

b. he's paranoid and doesn't know enough about what he has to feel confident. ( he's fairly new at this as well 2-3 years )

And that I should probally go with another service provider who won't give me these hassles. But I'm new at this, I know that at school when learning this, we didn't have to go through this. and were told that you only need ssl if you are using credit cards or other sercure information. I just want some feedback from everyone please.

thanks justin

jeremuck

if you are requiring people to login it's a security risk??
hahahaha

anyway, my host gives me SSL for free.

essentially he's saying that by actually limity the people that access parts of your website, you are creating a security risk?

largo

justinb,

That makes little or no sense. Your ISP has no reason to be concerned here unless they haven't done their job properly.

The other, and probably the most obvious reason, is your ISP just wants to make an extra buck by adding the SSL option. They probably want to make it a recurring monthly charge for using their "wildcard" cert and of course SSL installation charges.

I would recommend you do scout around for another ISP.

Here may be a decent place to start browsing:

http://www.hostsearch.com/

P.S: There were some better directories that I knew of, unfortunately I don't remember the URLs off hand. I'll find out tonight and let you know.

-m.

jeremuck

I use aresnetwork:
http://www.aresnetwork.com/

I've been pretty happy so far.