#dominoforever | Product Ideas Portal

 

Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.

For more information and upcoming events around #dominoforever, please visit our Destination Domino Page

Request to have LTPAToken does not contain the user's authenticated name to prevent brute force attack.

As the technote below mentions, LTPAToken cookie contains the user's authenticated name encoded base64.
That is, the attacker could crack the password by using a brute force attack.

How secure is the Domino LtpaToken cookie?
http://www.ibm.com/support/docview.wss?uid=swg21306272

Internet password lockout function; Server > Configurations > Security >  Enforce Internet Password Lockout, prevents brute force attack, though, it would be much more secure if LTPAtoken cookie does not contain the user's authenticated name.

  • Avatar32.5fb70cce7410889e661286fd7f1897de Guest
  • Feb 19 2019
  • Shipped
  • Attach files
  • Admin
    Thomas Hampel commented
    20 Feb 08:00pm

    Please note that the LTPAToken format was created and is owned by WebSphere, not by Domino.

  • Admin
    Thomas Hampel commented
    10 Jan 08:57pm

    You can change the contents of the LtpaUsername by using directory assistence