Re: [IUG] login security question

["David Jones" <djones at scu dot edu>]

>>> On 3/11/2010 at 01:58 PM, John Rutherford <aw8721 at wayne dot edu> wrote: 
> Has anyone found any useful work arounds? I will most likely
> submit these as enhancement requests at some point but am interested
> in your input prior to doing this in case I am missing some obvious (and
> simpler) solutions.

In addition to the non-standard ports for WMR, the IGR, WebBridge, and community manager authentications that run on regular port 80 definitely should go through SSL at least for the authentication part of the transaction.

The one workaround that I've contemplated is to create initials for each of the functions and only grant that single privilege to those initials. 

The problem with that is making sure that the appropriate staff remember yet another set of credentials for those functions that they need to access. The more extra functions you have, the more initials you have to create. 

It'd just be easier if every staff web login opportunity went through a SSL redirect similar to the WebPac [e.g., similar to https://your.lib.org/patroninfo/0/redirect=/illb could be something like https://your.lib.org/staff/redirect=/manual or https://your.lib.org/staff/redirect=/iii/community/reviews ].

HTH,
David


_____________________________________________________________________
David Jones                                     mailto:djones at scu dot edu
Library Systems Manager                  http://www.scu.edu/library/
University Library                               fax:   408-551-1805
Santa Clara University                            phone: 408-551-7167
500 El Camino Real
Santa Clara CA 95053-0500
_____________________________________________________________________
Logic must take care of itself.
-- Wittgenstein, Notebooks, 1914-196, 22.8.14




-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.