Securing Basecamp

At Eggplant, we use BaseCamp to manage our various projects. One of the nice features about BaseCamp is that it allows us to store files related to projects on a server (not on BaseCamp) and keep important documents available to the various projects easily accessible.

This creates two problems. For one, since the files aren't on BaseCamp's servers, you have to put the files somewhere, which means having an ftp login some where. A recent update now lets you use SCP, which is a massive improvement, so that's one problem down. The real problem though is that since the place where the files go has to be web accessible, it means that there is an open directory somewhere where all your files live. This is a major security problem and potentially really bad for relationships with clients. Especially when Google has a habit of finding things that it shouldn't, or at least, that I don't want it to.

Here's a solution.

1) create an htaccess password on the directory where you're storing the files
2) in the Basecamp url encode the user name and password:

https://eamorg:flapjacks@red.eggplantmedia.com/~basecamp/

Now you keep Google and other prying eyes out, while still keeping the files accessible to BaseCamp. Of course, if BaseCamp actually stored the files on their server, this wouldn't be a problem, but for now, it's a fix.