[3983] in WWW Security List Archive
Re: Lotus Notes Tender System
daemon@ATHENA.MIT.EDU (THunterD@aol.com)
Tue Jan 14 22:37:26 1997
From: THunterD@aol.com
Date: Tue, 14 Jan 1997 20:17:17 -0500 (EST)
To: linehan@watson.ibm.com, mprice@pwd.nsw.gov.au
cc: Www-Security@ns2.rutgers.edu
Errors-To: owner-www-security@ns2.rutgers.edu
Mark H Linehan on 01-13-97 09:37 PM wrote:
Lotus Notes has very extensive security features. There's a
documentation database that comes with Notes that describes these
security features in detail. Examples: it uses public-key algorithms to
authenticate users; mail and database entries can be signed or encrypted
or both; the transport link between Notes clients and servers can be
encrypted, etc. As with any security mechanisms, it takes some learning
and some thought to apply the Notes security features effectively. But
they can be very effective.
While the above is true, security must take into account the ability of
someone to compromise the access controls. Lotus Notes stores your password
in an ID file. The password remains with that ID file and not on the server.
Therefore, if I can compromise your password and get a copy of your ID file
I can have permanent access to your lotus notes database. To make matters
worse, the user can choose to either have a password or not. This option is
configurable at the client, so it is feasible that users may not even require
a password. Additionally, some of the basic security administration
functions are not available on Notes. Activities such as reviewing invalid
access attempts are not part of Notes. In order for a Notes application to
be secure it must be part of a larger solution which has comprehensive
security controls and policies in place and in force.
Tom Davis
