Concerning the “send data from site to site directly” feature, mentioned last week…
We decided to make sure that this was in our next UpdraftPlus release. This has caused the next release to be pushed into next week, as we didn’t complete testing in the first half of this week. The feature is now ready and has passed testing. We think this feature will be very popular. Here’s another screenshot of it in action:
Sending a backup to the destination site requires only that the sending site can reach the destination site (i.e. that it’s not firewalled from visiting the site). As long as that’s possible, and the destination site has UpdraftPlus installed, then it’s just a matter of copy-and-pasting a key in, and that’s all the setup required.
The ability to communicate with a remote site needs to be well protected, so that attackers on the Internet can’t send remote commands to your site. The communications protocol is designed according to best practices, and includes these features:
- All communications are encrypted.
- Encryption is industry-standard RSA encryption.
- Built on top of the most widely used PHP encryption library, phpseclib (in active development for over 6 years). There’s no home-brew encryption here!
- Encryption uses asymmetric keys, and each site only stores one of the keys. (So, if your WordPress database is broken into and an attacker takes it over, then the hacker can’t impersonate the other site).
- Protection against replay attacks. (In a replay attack, and attacker who can watch the network communications grabs encrypted traffic, and if he can work out what a message did, later re-sends it to do the same again. This is an attack that someone can use on a protocol without replay protections, without needing to decrypt the messages).
That’s all “under the hood” – as I say, to set up a connection, all you need to do is visit one site’s UpdraftPlus settings, copy the key shown to your clipboard, and then paste it on the other site. Copy, paste, send!
David Anderson (lead developer, founder, UpdraftPlus)
