Password Security

Passwords play a major role in the Domino security model and are used to authenticate both Notes and Web users. Authentication is the process of ensuring that a user or server is who it claims to be. Whether you are accessing Domino with a Notes client or a Web browser, you should always use well-crafted passwords to reduce the likelihood that someone can guess or hack your password. Use the following guidelines to help ensure that you are using a strong password:

• Do not use common words found in a dictionary.

• Use a mixture of numeric and text characters.

• Use mixed case characters.

• Intermingle punctuation characters.

• Use eight or more characters.

• Do not use easily discernable personal information.

Web Password Security

Web users who attempt to access a secured resource are required to authenticate themselves before the Domino server grants them access. For a Web user to be authenticated, he or she must supply a user name and password pair (basic authentication). The Domino server attempts to find a Person document in the Domino Directory that matches the user name supplied. If a matching Person document is not found, the user is not granted access. If a matching Person record is found, the password supplied by the user is compared to the password stored in the Internet Password field (the actual field name is HTTPPassword), which can be found on the Basics tab in the Person document.

Internet passwords are encrypted through the use of a one-way hashing algorithm. To do so, use the @Password function in the Input Translation event of the HTTPPassword.

If a match is made on the password, the user is authenticated and the Domino server then grants access based on the username supplied.

Notes Password Security

The Notes client model is somewhat different. When Notes users attempt to access a Domino server that does not allow anonymous Notes client access, the certificates stored in their Notes ID files are used to authenticate them.

Users must supply a password that matches the one stored in the Notes ID file to unlock it. Users who cannot supply the matching password are unable to use Notes.