Architecture / Installation

> ..
>
>
> But it doesn't protect that much for hackers who use programs to crack passwords.
> I can make a very complex password if I want and that will take them a lot of time.
>
> But what about other people I give admin and editors rights?
> I can't check how they protest their passwords, or how simple or complicated, or they keep their PC free of spyware, or they use that same or similar password on other places, and so on.

I assume you are giving admin or editor rights to people that you trust and have a working relationship with. This would include, I think, letting them know your concerns about password strength and spyware on their computers, etc. and getting some agreement and cooperation from them on those things.

>
> Yes: I opted for minimal 8 characters and numbers and letters to be used in the password.
> But even then, someone can make it simple to crack.
> A simple method is making it impossible for hacker software to check many different possible password combinations.

There are very, very many combinations of 8 characters. I don't know who'd be motivated to use a brute force attempt on your Tiki, but it seems rather unlikely they'd try or succeed. If you monitor your visitor logs you can start banning IPs when many failed log-in attempts are made.

> Also the CAPTCHA registration image is simple; if one compares it to Yahoo and others.
> Why would they make it more complex? Probably there is software to crack simple CAPTCHA images?

Yes, Tiki's is comparatively easy to get around with OCR but again CAPTCHA is not anti-hacker or -script kiddie, it's anti-bot/spider.

> But that also doesn't work (bug). Actually I prefer CAPTCHA for loggin in, instead of Email address, because mostly an email address can be retrieved easily.

All CAPTCHA does is make sure a human is visiting the site (or a good OCR tool is) to recognize the characters. It isn't an authentication method since the required input information is public, albeit contorted visually.

-- Gary