Security settings for ConfTool Pro (password strength, session times and CAPTCHAs)

How access is controlled in our ConfTool installation? How are users authenticated and authorized to login? Can we define security settings?

As each ConfTool installation contains not only personal data, but usually also research results and other intellectual property and/or registration information, access to the system is controlled by valid user names and passwords. Depending on the data stored in your ConfTool system and the security requirements of your organization, you might have to set higher security standards for your installation. Therefore, ConfTool Pro offers separate settings for each installation like the “Password Settings for User Accounts”, “Session Timeout Settings” and “CAPTCHAs”.

To update your “Security Settings for User Registration and Management”, please go to:
Overview => Settings => Settings for User Registration => Security Settings for User Registration and Management

1) In the section Registration of New ConfTool Accounts you can define the security settings for creating a user account (see image 1).

• Account Options for New ConfTool Users: Please define whether user name and password have to be entered manually ("Show user name and password fields (default)"), or user name and password can be generated by the system ("Optional password generator"). For more detailed information please consult the forum entry Requirements for user login passwords.
• Secret Key and URL to Access New User Registration Page: You can define a string of numerals and characters (as "secret key" that will be used as part of a "secret URL") to allow people to create new user accounts even if user registration has been disabled in the backend.

2) To update the minimum security requirements for user accounts, please check the Password Settings for User Accounts (image 2):

• Password Requirements: Defines the minimum password strength in length and complexity. Choose between “low”, “normal”, and “high”.
• Extra Mail for Password: Sends an automatically generated password to users in a separate e-mail without the user name. No password e-mail is sent if users choose their own user name and password.
• Two-Factor Authentication: Adds a second step to secure access to the system. Users enter one-time passwords generated by a mobile app such as Google Authenticator. By default, it is required only for users with “Admin” status or other administrative rights; optionally, you can enable it for all users.
• Warning E-Mail on Login From a New Browser: Notifies the account holder by e-mail about the time, browser, and country of the login, with a link to change the password and enable two-factor authentication. This option can be activated for specific user groups.
• Skip Two-Factor Code on Trusted Browsers: When entering a valid two-factor code, users can select “Trust this browser” to skip the code on that browser for the chosen period (disabled, 7, 30, or 90 days). Admin accounts are trusted for 7 days at most.

3) Session Timeout Settings let you determine how long specific user groups are connected with the installation before inactivity triggers an automatic log out (image 3). Please keep in mind that short timeouts increase security while configuration of the system (Admins), organization of the reviewing process (Chairs) or registration (all other users) all need enough time to be completed. Therefore, you can define Session Timeouts for some groups of users in particular.
As soon as the time limit has been exceeded without user interaction, users just have to login again (image 4). Please note: Two minutes before a user is logged out of the system, a warning message is displayed.

4) You can enable CAPTCHAs ("Completely Automated Public Turing test to tell Computers and Humans Apart") for your ConfTool Pro installation both for new user registrations and the login process (image 5). Please note that CAPTCHAs are usually not required because ConfTool Pro already uses several “invisible” mechanisms to avoid the automatic creation of user accounts. There is no considerable benefit in creating fake user accounts and the system always blocks brute-force login attacks.

Three different types of CAPTCHAs are available:

• SecurImage is a classic CAPTCHA that requires a sequence of a few letters to be entered into a text field. This mechanism is provided by ConfTool GmbH and runs on our servers only.
• Google reCAPTCHA V2 uses an advanced risk analysis engine and adaptive challenges. It means that users usually just have to select a checkbox or they have to select some images with certain properties. Please note that some people (for example, people living in China) have limited access to Google and this service.
• ALTCHA requires no reading and no listening. Instead, the browser solves a small computing task and users only have to select a checkbox. ALTCHA is provided entirely by the ConfTool installation: no data is transferred to third parties and no cookies are set.

All three types are available for the login page. If enabled, the user has to complete the CAPTCHA to log in to the system (see images 6, 7 and 8 ). Please note that after 10 unsuccessful login attempts users and their IP will be blocked for 10 minutes.

If CAPTCHA is enabled for the user registration process, each user has to enter letters correctly (“SecurImage”, image 9) or tick the checkbox (“Google reCAPTCHA V2” and “ALTCHA”, see images 10 and 11) to create a new user account. “Google reCAPTCHA V2” may additionally show an image challenge.