nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Login Screen Password encryption?

kvargas23

Hi All,
I need to provide my corporate security team with a little more information regarding how we secure the TeamSite Login Screen, especially the password encryption portion. I see the login form "encrypts" the password before posting back to the server

The question is: How does it do this? via some simple JavaScript client library? via some custom TeamSite magic? via an industry standard encryption library?

Yes, I RTFM, but that didn't help and searching this forums didn't turn up any prior discussions, and something a little more concrete than telling others not t worry, its taken care of by the vendor :-)

Thanks for any info.
Keith

Find more posts tagged with

Comments

ISCBorisB

Hi All,
I need to provide my corporate security team with a little more information regarding how we secure the TeamSite Login Screen, especially the password encryption portion. I see the login form "encrypts" the password before posting back to the server

The question is: How does it do this? via some simple JavaScript client library? via some custom TeamSite magic? via an industry standard encryption library?

Yes, I RTFM, but that didn't help and searching this forums didn't turn up any prior discussions, and something a little more concrete than telling others not t worry, its taken care of by the vendor :-)

Thanks for any info.
Keith

Your concern is definitely valid but - you will not get any security details information on the open Forum.
Talk to the support, see how far and on what NDA conditions Vendor is going to go

kvargas23

After more research, I found my answer, and the TeamSite login screen does a really poor job of securing credentials. I won't post them here so as to not cause a firestorm. I'll talk to support on this as its easy to exploit. The login screen should at a minimum force https.

I've been doing Interwoven development and support since 2000 and this one slipped by. Its actually quite shocking and unacceptable in today's global enterprise climate.

Thanks Boris.

ISCBorisB

After more research, I found my answer, and the TeamSite login screen does a really poor job of securing credentials. I won't post them here so as to not cause a firestorm. I'll talk to support on this as its easy to exploit. The login screen should at a minimum force https.

I've been doing Interwoven development and support since 2000 and this one slipped by. Its actually quite shocking and unacceptable in today's global enterprise climate.

Thanks Boris.

Vendor provided encryption is the minimum, you have options. Remember, before LiveSite introduction normal
system setting was behind corporate firewalls, not exposed to the Net directly. And if your firewalls are not good
enough, CMS will be the least of your problems.

Further, although admittedly not enforced you can configure your TS (not just login) to require SSL. If that is
not sufficient still, add one of the TS supported SSO's like SiteMinder, Kerberos, etc...