Changeset 2622921
- Timestamp:
- 11/01/2021 05:46:07 PM (4 years ago)
- Location:
- loginshield/trunk
- Files:
-
- 5 edited
-
README.txt (modified) (6 diffs)
-
admin/class-loginshield-admin.php (modified) (2 diffs)
-
admin/js/loginshield-admin.js (modified) (1 diff)
-
includes/class-loginshield-activator.php (modified) (1 diff)
-
loginshield.php (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
-
loginshield/trunk/README.txt
r2598262 r2622921 8 8 License: GPLv2 9 9 License URI: http://www.gnu.org/licenses/gpl-2.0.html 10 Stable tag: v1.0.1 310 Stable tag: v1.0.14 11 11 12 LoginShield for WordPress is a more secure login for WordPress sites. It's easy to use and protects users against password and phishing attacks.12 LoginShield for WordPress is the secure and convenient way to login to your WordPress site. It's easy to use and protects users against password and phishing attacks. 13 13 14 14 == Description == … … 33 33 34 34 = Self-service activation = 35 After you install and set up the LoginShield plugin, users can easily 36 activate LoginShield for themselves in their profile settings page. 35 After you install and set up the LoginShield plugin, users can easily activate LoginShield for themselves in their profile settings page. 37 36 38 37 = One-tap login = … … 42 41 43 42 = Digital signatures = 44 Some of the most common ways that accounts are hacked are weak passwords and 45 stolen passwords. This is why so many sites require users to come up with 46 passwords that have special characters, and to change their passwords periodically 47 (in case a current password was reused somewhere and cracked). But this is 48 annoying to users and doesn't guarantee they will actually pick a secure password. 43 Some of the most common ways that accounts are hacked are weak passwords and stolen passwords. This is why so many sites require users to come up with passwords that have special characters, and to change their passwords periodically (in case a current password was reused somewhere and cracked). But this is annoying to users and doesn't guarantee they will actually pick a secure password. 49 44 50 LoginShield uses digital signatures for authentication instead of passwords. 51 This makes LoginShield a passwordless authentication system. 45 LoginShield uses digital signatures for authentication instead of passwords. This makes LoginShield a passwordless authentication system. 52 46 53 Digital signatures are far stronger protection for an account than passwords, 54 and they don't require the user to come up with anything or remember anything. 55 LoginShield automatically generates and uses a separate credential for each 56 website, so you can use the same LoginShield app to login to multiple sites. 47 Digital signatures are far stronger protection for an account than passwords, and they don't require the user to come up with anything or remember anything. LoginShield automatically generates and uses a separate credential for each website, so you can use the same LoginShield app to login to multiple sites. 57 48 58 LoginShield uses strong, modern cryptographic algorithms and parameters to 59 ensure your accounts get the best protection available. 49 LoginShield uses strong, modern cryptographic algorithms and parameters to ensure your accounts get the best protection available. 60 50 61 51 = Strong multi-factor authentication = 62 The LoginShield app itself can be protected by a password (which never leaves 63 the mobile device) or a fingerprint. This is far better protection than the 64 standard two-factor authentication that many sites use. 52 The LoginShield app itself can be protected by a password (which never leaves the mobile device) or a fingerprint. This is far better protection than the standard two-factor authentication that many sites use. 65 53 66 54 For more information, read about [authentication factors](https://loginshield.com/article/authentication-factors/). … … 69 57 LoginShield is the ONLY authentication solution to offer phishing protection. 70 58 71 Many data breaches start with a phishing email, tricking the user to log in to 72 the attacker's website that is impersonating the real website. Any website that 73 uses passwords to log in is vulnerable to this. 59 Many data breaches start with a phishing email, tricking the user to log in to the attacker's website that is impersonating the real website. Any website that uses passwords to log in is vulnerable to this. 74 60 75 Websites that use standard 76 two-factor authentication codes are also vulnerable -- whether they send the code 77 via SMS or use an OTP app to display it, the fact that you enter that code into 78 the website after the password prompt means a phishing attacker will also get the 79 code. 61 Websites that use standard two-factor authentication codes are also vulnerable -- whether they send the code via SMS or use an OTP app to display it, the fact that you enter that code into the website after the password prompt means a phishing attacker will also get the code. 80 62 81 Websites that use an authenticator app with push notifications are ALSO 82 vulnerable to this, because they don't confirm that you're at the correct website 83 when you tap the "login" button in the app. 63 Websites that use an authenticator app with push notifications are ALSO vulnerable to this, because they don't confirm that you're at the correct website when you tap the "login" button in the app. 84 64 85 Only LoginShield is able to detect that the user is not at a trusted website 86 and route the user to the correct website, completely circumventing a credential-theft 87 phishing attack. 65 Only LoginShield is able to detect that the user is not at a trusted website and route the user to the correct website, completely circumventing a credential-theft phishing attack. 88 66 89 67 For more information, read about [phishing protection](https://loginshield.com/article/phishing-protection/). … … 140 118 141 119 == Changelog == 120 121 = 1.0.14 = 122 * Fix: realm not found error when connecting to LoginShield account 142 123 143 124 = 1.0.13 = … … 207 188 = User Name and Email = 208 189 When a user activates LoginShield in their profile settings, their name and email address are sent to LoginShield to register the user. 190 209 191 This information is later used by LoginShield for service-related communication with the user, such as our phishing protection feature. We DO NOT sell or share this information with anyone else, except as required by law. If the user deactivates LoginShield, and wants to delete this information, the user can visit [https://loginshield.com](https://loginshield.com) to delete their LoginShield account. 210 192 -
loginshield/trunk/admin/class-loginshield-admin.php
r2517999 r2622921 74 74 75 75 // Initialize settings 76 add_action( 'admin_init', array( $this,'loginshield_settings_register' ) );77 76 add_action( 'admin_init', array( $this,'loginshield_activation_redirect' ) ); 78 77 … … 404 403 } 405 404 406 407 405 /** 408 406 * Redirects the user after plugin activation. The redirect happens only under the -
loginshield/trunk/admin/js/loginshield-admin.js
r2515142 r2622921 485 485 486 486 checkRealmStatus: async function() { 487 const response = await this.handleCheckRealmStatus(); 488 489 const { status, error, message, realmId } = response; 490 491 if (status === 'success') { 492 console.info(message); 493 this.showNormalForm(); 494 this.$realmIdText.text(realmId); 495 return; 496 } 497 498 if (error) { 499 console.info(message); 500 this.showAccessRequestForm(); 487 try { 488 489 const response = await this.handleCheckRealmStatus(); 490 491 const { status, error, message, realmId } = response; 492 493 if (status === 'success') { 494 console.info(message); 495 this.showNormalForm(); 496 this.$realmIdText.text(realmId); 497 return; 498 } 499 500 if (error) { 501 console.info(message); 502 this.showAccessRequestForm(); 503 } 504 } catch (err) { 505 console.error('checkRealmStatus failed', err); 506 this.showAccessRequestForm(); 501 507 } 502 508 }, -
loginshield/trunk/includes/class-loginshield-activator.php
r2515142 r2622921 32 32 public static function activate() { 33 33 /** 34 * Create options if they don't already exist. Existing options will not be updated. 35 */ 36 add_option( 'loginshield_realm_id' ); 37 add_option( 'loginshield_access_token' ); 38 add_option( 'loginshield_access_token_not_after' ); 39 add_option( 'loginshield_refresh_token' ); 40 add_option( 'loginshield_refresh_token_not_after' ); 41 add_option( 'loginshield_webauthz_discovery_uri' ); 42 add_option( 'loginshield_webauthz_register_uri' ); 43 add_option( 'loginshield_webauthz_request_uri' ); 44 add_option( 'loginshield_webauthz_exchange_uri' ); 45 add_option( 'loginshield_client_id' ); 46 add_option( 'loginshield_client_token' ); 47 add_option( 'loginshield_realm' ); 48 add_option( 'loginshield_scope' ); 49 add_option( 'loginshield_path' ); 50 add_option( 'loginshield_client_state' ); 51 add_option( 'loginshield_login_page' ); 52 53 /** 34 54 * Create LoginShield Login Page. 35 55 * -
loginshield/trunk/loginshield.php
r2598262 r2622921 21 21 * Plugin URI: https://loginshield.com 22 22 * Description: LoginShield for WordPress is a more secure login for WordPress sites. It's easy to use and protects users against password and phishing attacks. 23 * Version: 1.0.1 323 * Version: 1.0.14 24 24 * Author: Cryptium 25 25 * Author URI: https://cryptium.com … … 38 38 * Current plugin version, in accordance with https://semver.org 39 39 */ 40 define( 'LOGINSHIELD_VERSION', '1.0.1 3' );40 define( 'LOGINSHIELD_VERSION', '1.0.14' ); 41 41 42 42 /**
Note: See TracChangeset
for help on using the changeset viewer.