It appears this web site has a security problem?
Subject: Posting from Michael B & Michael B. Hughes are from the same person
Huh? You self-register with two different ids and call it a security problem? The key there is that you self-registered – you can use any “screen name” you want. If someone else is able to post using a web browser under the name Michael B. Hughes without getting the password from you (or from your end of the chain, at least), THAT would constitute a security problem.
Subject: Perhaps more explanation is needed…
I didn’t register with TWO names as you indicated. I only registered with ONE name (michael b) and with ONE password; however, about every other time I submit a response, it comes up as Michael B Hughes.
I can access Michael B Hughes profile, but have not changed anything. I have reported this to Lotus (the first times was several months ago) and then I reported the problem again yesterday. I am able to see documents (Show all my posts) by michael b or Michael B Hughes.
Sometimes, when I submit a response michael b appears, but more often than not, it shows up as Michael B Hughes.
It is a SECURITY problem. And I received confirmation of that fact after my first report of the security problem to Lotus. But nothing had been done.
What I don’t understand is why Lotus will not fix it? I know we are not dealing with worldly secrets here, but…
Subject: RE: Perhaps more explanation is needed…
So you’re not Michael B Hughes and didn’t create that account.
I just created a “Dmitry A” account to see whether I can impersonate Dmitry A Khudorozhkov, and it doesn’t appear that I can. This might be happening because you have the same password as the Micheal B Hughes account. Have you tried changing the password on the Michael B account to see whether that clears it up?
As Stan noted, there’s a relevant server security setting. If the server is told to let users login with name variants and should guess who they meant to say they are, the server could in my opinion be excused for getting confused if the name could match two users and the password is the same for both users.
Subject: RE: Perhaps more explanation is needed…
Just an update! I received a note from Lotus the problem was resolved. However, after posting a response yesterday, the same problem occurred. Considering I use initials and numbers for a password, the likelihood of a duplicate is highly unlikely. Oh well!!
Subject: RE: Perhaps more explanation is needed…
Then use the forum feedback to let the webmaster know. (Should be “fewer variations” set.) Had you even considered using the tools provided rather than just complaining publicly? THESE FORA ARE NOT MODERATED.
Subject: I did that very thing, sent feedback to webmaster.
And as I said, it was months ago I sent the first notice. So my annoucement is not compliant I don’t believe, as you indicated, but perhaps another way to get some attention drawn to the SECURITY problem.
Subject: Perfect example, look who created this one!!!
Same login and password.
Subject: RE: Perfect example, look who created this one!!!
And yet you keep posting here rather than using the feedback. Hmmm. Vent away, Don Quixote!
Subject: RE: RE: Perfect example, look who created this one!!!
Did you not read any of my postings? As you so eloquently suggested, I did notify Lotus using the feedback device, months ago. I mentioned that fact earlier. Yet, nothing has been done.
And help me understand why you disagree with the posting of the security problem. I didn’t cause the problem. I’m justing trying to get it resolved.
While I agree with you that the posting probably will not help to resolve the problem, perhaps, if nothing else, maybe it will support the reported problem, if Lotus would take the time to resolve.
My main concern is this and I know it’s just my opinion, but it certainly doesn’t look very good if Lotus has a security flaw on their forum site and they choose not to take any action. As for as whether my posts are listed as michael b or Michael B Hughes, makes little difference to me. I’ll continue to use the site and assist others, if I can. I have gleemed lots of great information from this site and continue to get new ideas daily.
If Lotus doesn’t take the time to resolve this issue, what other issues are they choosing not to take action on…that concerns me as a Lotus Notes Developer and would think others might be concerned as well.