Login to participate
Security IdeasRSS
4

SEPM console username should not be case sensitive

Jeff Vandervoort's picture

SEP & SAV are the only products I can think of where the username is case-sensitive, and it's a nuisance.

Better still...use Windows passthrough authentication.

mon_raralio's picture

0.02c

As for the other suggestion of the logon being case sensitive. I think it is fine the way it is. 26 additional characters for "them" to guess.
Although I've been using *nix OS for a few years now. So I got the hang of it.

chenh's picture

My $.02

I think user name should be case insensitive, not sure Symantec intentionally coded that way, personally I perfer username is case insensitive. also the box for for entering password should return blank if a wrong password is attempted, plus if username case sensitive is more important/secure, then Syamntec should dispaly different "error" message on the screen between username case sensitive issue and wrong password.

mon_raralio's picture

re: different error messages.

I'm not sure about that one. It could be easier to guess if you know where you went wrong.

Serengeti's picture

Domain and Group Names as well

the domain name should also not be case sensitive
come to think of it, neither should the Client Group names. If u create a Sylink to drop and move a client to a new group, the case of teh Preferred group must exactly match the Group in the database or els ethe client will be place in "Default Group".
This looks like something that got fotgotten in the code.

Security Engineer, London