HCL Domino Ideas Portal

Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.

For more information and upcoming events around #dominoforever, please visit our Destination Domino Page

Add a new idea Subscribe
Status Shipped
Workspace Domino
Categories Security
Created by Guest
Created on Feb 19, 2019

RELATED IDEAS

Request to have LTPAToken does not contain the user's authenticated name to prevent brute force attack.

As the technote below mentions, LTPAToken cookie contains the user's authenticated name encoded base64.
That is, the attacker could crack the password by using a brute force attack.

How secure is the Domino LtpaToken cookie?
http://www.ibm.com/support/docview.wss?uid=swg21306272

Internet password lockout function; Server > Configurations > Security >  Enforce Internet Password Lockout, prevents brute force attack, though, it would be much more secure if LTPAtoken cookie does not contain the user's authenticated name.

  • Attach files
  • Admin
    Thomas Hampel
    Reply
    |     Feb 20, 2020

    Please note that the LTPAToken format was created and is owned by WebSphere, not by Domino.

  • Admin
    Thomas Hampel
    Reply
    |     Jan 10, 2020

    You can change the contents of the LtpaUsername by using directory assistence

    grafik.png
    grafik.png
    Open full size
    grafik.png
Copyright © 2023 HCL Technologies Limited