I am very much an advocate for 2 factor authentication tokens or keys such as a Yubikey, these devices can interface with web browsers through a Javascript API that web browsers expose or in the case of Firefox not expose.

There is a community made extension that fills this gap until the Firefox devs get the U2F JS API implemented in version 57 or 58 however I was never able to get it to work, no matter what I tried and no matter how many times I ran the test it just kept popping up with a message saying "Please plug in your U2F device".

Then I found the source code on GitHub and the last line in the README contained the key...

Alot of PHP applications that i've worked on that allow file uploads place the files into a directory that is publicly accessible, this isn't a problem so long as your upload script never ever allows scripts to be uploaded.

It doesn't matter how good you think your MIME type or extension filtering is why allow the PHP interpreter near the files you never expect to be interpreted?

A little while back I signed up for the Lets Encrypt beta for this domain, recieved an email today confirming that I had been invited to join the beta! And that I could generate a free SSL cert!

So I immediately did!

Some times you want to delete a file and for it to stay deleted forever, SSH/SSL private keys, sensitive documents, old password databases, etc...

Anyone who has ever accidentally deleted a file or had a hard disk fail knows there are a million and one tools out there that will undelete and recover these files.

This is were shred comes in...