To TOTP, or NOT To TOTP, Traveler/Verse users, THAT is THE Question

 

Whether 'tis nobler in the mind (of users) to suffer The slings and arrows of outrageous fortune security guidelines, Or to take arms against a sea of (illogical) troubles, And, by opposing, end their tyranny upon us?

Shakespeare will have to live with my edits.

Enjoy the video because it is THE definitive way to say the quote :-)

Now that Collabpshere has finished, it was a great event once again managed by Richard Moy with a supporting cast of dozens of people, I had a follow-up item from my session.

I will post the slides once I find a new home now that Slideshare has gone paywall.

The question continues to arise about using TOTP for Verse(Traveler) users.

If you attended my session, you heard me discuss the pro (not sure if there is anything beyond my insurance/compliance or security people require it) and the many cons. 

If anyone has more PRO reasons, let me know, but for now, this is the slide I used.

Remember that current phones usually require a code, slide design, finger, face, or eye scan just to let you into your phone.

Then the Verse app has a login and password for itself.

Do you still need an MFA after 2 levels? 

Also, if the whole purpose of the MFA is to secure the mail application, what purpose does it serve by being on your phone, if your phone is lost or stolen? Let's say the robber has the initial code(stop using your birthday or kid's birthday or anniversary). Then having the fa there is totally useless. 

So, why do you want to enforce this?

Right, because your insurance company told you.

Oddly enough, they did not tell you to disable SSO(Single Sign On), which negates any aspect of MFA a computer might have to start with. Nor do they expect you to have an MDM solution, which is really what you need for this purpose. 

Traveler/Verse has some aspects of MDM, like remote wipe, but does not verify your device has the appropriate number of digits in your passcode.

So, again, why do you need to do this?

Have you asked for the technical guidance document from your insurance company?

You should let me know if any of them ever produce one. And if they have one, does it make any sense?

TOTP is URL-based, not Server or Domain-based.

You can let Verse users use the usual traveler.company.com URL without TOTP while maintaining TOTP enabled for webmail.company.com see my slide below.

Yes, you can change the TOTP time-out setting (https://help.hcltechsw.com/traveler/12.0.0/auth_timeout_totp.html), which I did on my personal server, so I only log in with TOTP if my phone has been off for more than 18 hours. This happens every weekend, I shut it off an hour before sunset and turn it back on after sunset on Saturday.

The choice is yours, as the Admin, but you will have more help desk tickets every Monday morning and possibly every time a user flies, and they will think they are locked out.

So, in the immortal words of the Bard of Avon,

 "Out of this nettle - danger - we pluck this flower - safety."

'Henry IV, Part 1' (1597) act 2, sc. 3, l. [11]

Engage Recap

I can't even begin to tell you all the things we saw and learned, and that was before Engage even started,

Highlights include:

Forgot to add this: Restyle. It will update your old Domino applications appearance and give it a modern look in minutes! Totally cool!

1. Project Keep is back
2. R13.0 is a 2024 thing, with 12.02 being out by Q4-22 and 12.03(or maybe 13 if they change their mind) in 2023.
3. The designer client is getting redone(no idea what that means) for the 2023 time frame,
4. When I asked about the admin client, it was missing from Barry Rosen's slide. I got some interesting answers, so something is brewing, but no date is planned, so think R13. For that keeping score, Tim Clark is PM for Admin client.
5. 12.02 I think they said they will have Busytime lookups for O365 invitees, maybe 12.03, either way, this is great and needed by everyone.
6. More DKIM and SPF, and DMARC parts are coming soon.
7. Verse 3.0 is out soon(June). Less iNotes more purposeful built things in it. Read the Read me file as Agnes said, Beta for Verse means something is included but not default turned on. So check it out and RTFM.
8. HCL VOLT MX GO was announced to help customers connect more parts of their world to Domino and vice versa. Jason Gary did a pitch about the name at Engage. If you remember the 90s/00s when we had Domino Go Server and similar things, you get what this is about.
9. Verse mobile is the Traveler client. Confusing? Yes, is it going to be changed? No.
10. In my session, half the room was already on R12, and I would think many of the customers that attended were as well.
11. Sametime 12 is available. It only runs in a container.
12. HCL is pushing out ALL the 3 tiers of languages on the GA dates, unlike IBM, which made everyone wat 30/60/90 days. 
13. Certifications and HCL Training are coming back, Luis Guirigay's slides should be reviewed for more details. Engage will be posting the slide decks shortly.
14. Talk about having a by default ODS update built into the client when you install it.
15. The ability to swap who is sending the email is getting enhanced further. 
16. Just a reminder, 12.01 had a names.nsf template update you want to use, especially if you are working on a TOTP plan.
17. Nomad will not require Safelinx any longer, thanks to the dev team that said "we can do this" and they did!
18. Chocolate is good, free chocolate is better, but free beer is the best.

I went into the event relatively neutral but left very upbeat and impressed by HCL and what they are saying and showing. While I may disagree with the dev first mentality, I am, after all, a long-time (29 years?!) messaging and an admin person.

If you do not go to these types of events, where everyone from Richard Jefts down to the sales and tech staff is accessible, you are missing out on having yourself heard.

My time with Richard, was really insightful. Then again, so were my discussions with Barry, Andrew, Scott, Michael, Luis, and many more people, even the great Gareth Cook of the iNotes Redirector fame.

Thank you to Theo and Hilde for once again putting on a great event and making everyone feel comfortable and happy to be part of the extended Yellowverse family.

Lastly,  I want to thank Martin Vogel for presenting with me. It was his first time presenting at Engage and his first time presenting in English. He nailed it. I will be posting our tips over the next few weeks because Slideshare no longer works the way it used to, and some of the tips should be searchable and not hidden in a presentation.