Re: Password Recovery mail-in database

Recovery information is not changed when users change their passwords nor
when they are recertified. From admin help: "When users acquire a new
public key, accept a name change, or accept or create a document
encryption key, Domino automatically sends updated encrypted backup ID
files to the centralized database. In the case of a server-based
certificate authority , the recovery database will be updated once the
user has connected to the server. Recertifying a user does not generate an
encrypted copy of the ID file to be sent to the recovery database, as a
user's Person Document already contains the updated public key."

Whenever the admin changes the recover information in the certifier, that
will trigger all the users to send in new recovery information. So every
time you add or remove a person who can recover ID's or make other
changes, expect a new wave to come in. Be cautious if you upgrade the
Notes ID security from 64 to 128 bit (or I presume to 256 bit with Notes
8). I found I could no longer recover ID's after my personal ID strength
was increased. I had to update the recovery information (make some minor
change) to trigger all new ID files to be sent in so I could recover users
ID's again.

I keep the old copies in the mail-in database, as sometimes they come in
handy, but not too often. I would think 2 or 3 would suffice if you must
clean.

The mail-in ID files are Encrypted (hence the "E" in "IDE"), and have to
be recovered to use them. So you can recover from ID file if the user has
it, or from the mail in database if they lose it. I use the mail-in ID's
to recover their actual ID's all the time as it is quicker to pull one out
of the DB then to get to their original. The database should be more up
to date the original backup, if you rename users, etc.

Storing the ID file in the address book is really only bad if you use weak
passwords. It is very handy to keep them there for new workstation setup,
but if they have a "default" password or are easily crackable, that is a
weakness.
===============================================
Tom Kreimer
Senior AS400 LAN-WAN Network Specialist
Buckhorn Inc, Milford OH