For security reasons, I want to block the use of ReadViewEntries on specific databases. How can this be done?
Subject: That won’t make your data secure (WAS: Block ReadViewEntries)
Subject: Block ReadViewEntries
Guys… there are valid security reasons for wanting to block ReadViewEntries, even on an already secure application.
For instance, you might consider your Domino Directory secure. Yet any authenticated user can access…
http://server/names.nsf/($Users)?ReadViewEntries
…and there’s quite a bit of potentially compromising information revealed there.
Glenn, blocking ?ReadViewEntries is best accomplished with a server URL mask. Otherwise, I’d suggest searching for “?ReadViewEntries” on notestips.com. Mike’s already documented some good stuff there.
Subject: RE: Block ReadViewEntries
Thank you.
Subject: Block ReadViewEntries
As Ben Poole stated, it will just make the data a little harder to get at, not secure.
The only effective means of security are:
-
Server access, controlled by the Server Document.
-
Database access, controlled by the ACL.
-
Document access, controlled by Readers fields (and $PublicAccess)
In that order.
Subject: RE: Block ReadViewEntries
OK. Thanks for the lesson on security.
I still need to block ReadViewEntries. Do you have an answer to my specific question?
Subject: Way to go in getting help
Subject: RE: Block ReadViewEntries
I am a little puzzled, here.
You state that for security resons, you want to do a certain thing. I tell you that this doesn’t add to the security, and you choose to re-ask the exact same question.
I had a look at your own web-site http://www.gorenstein.com/notes.htm and quote your own words: “Using Notes unparalleled security model in your custom applications ensures your trade secrets remain secrets.”.