Hiding Data in HTTPPassword Field

HCL Domino Domino Forum
1

Recent news of the possible HTTPPassword exploit in WebMail R5/R6 got me to thinking. If a user had even Reader access to the Public Directory/NAB, that user could right-click on any Person document and see the HTTPPassword hash. If that’s the case, that user could theoretically decrypt any HTTPPassword in the whole system, right?

I have to believe I’m missing something here. Is the exposure really that great?

I’m much more a developer than an administrator, so I tried to search here and Google looking for an answer. I didn’t see anything that I could recognize as an answer.

Can anyone confirm the scope of the problem? Or (I hope!) point out what I’ve missed?

Thank you in advance!

2

Subject: Hiding Data in HTTPPassword Field

“More secure Internet password format” makes the dictionary and brutal force attack on password much more difficult, in many cases impossible.And you are completely right in your understanding of the potential problem. I had a Sametime Bot which accepted a hashed password and returned plain password from lookup to a large dictionary database. A 6-letters non-dictionary word would take a couple of days to decrypt. Takes about the same time for getting password from ID-file.

/Andrei

http://dominounlimited.blogspot.com

3

Subject: RE: Hiding Data in HTTPPassword Field

Thanks for the tip about “More secure Internet password format”!