Offline deactivation with self-destruct

Hi,Would it be possible to make the offline activation response files self destruct on use? For example store a hash of the XML and don't allow it to be used again. This would help close the possible hole where the customer deactivates and sends us the deactivation file, but then immediately reactivates using the same file again (see also other recent thread on this topic).

We might actually implement this ourselves but it won't be as secure as if you did it.

Regards,Robin

Would it be possible to make the offline activation response files self destruct on use?

No.

For example store a hash of the XML and don't allow it to be used again.

No, this could be easily reset.

This would help close the possible hole where the customer deactivates and sends us the deactivation file, but then immediately reactivates using the same file again (see also other recent thread on this topic).

We'll be adding the ability to block this behavior in LimeLM (by not allowing offline deactivations without permission while the online activation response file has not yet expired).

Hi,

>by not allowing offline deactivations without permission while the online activation response file has not yet expired

I'm not sure what you mean by "without permission". The user is offline so there can be no permissions check.

Robin

The deactivation request still goes through LimeLM servers, and that's where you can control whether the customer is allowed to deactivate or not.

Reply
Discard post