Hi Ryan,
this cannot be implemented because it would make it easy to circumvent the lockdown. If the file isn't encrypted entirely, nothing would stop your users to just open the document and tamper with the XML to remove the lockdown. To make lockdown reliable and secure, we need to prevent that by using full encryption.
Regards,
Stefan
Correct, which is why I was proposing an alternative to lock-down. I don't need such impactful security, I literally just need a clean way to prevent accidental changes. I'm thinking instead of an option within the lock-down tab, a separate security tab just labeled "read-only" mode or something similar.
Just to be sure I understand. You're not looking for something enforcing in the document but rather something in the UI which prevents accidental changes. Like an option to enable/disable the ability to edit the file quickly. Is this correct?
Essentially yes. These documents are automatically included and loaded with our installer so people don't always realize they are controlled documents and shouldn't be edited without the change being approved. My thought was requiring a password like the lock-down document to write a change, but only be prompted for it when actually making a change. I don't want it to require a password to load, since again, it's automatically installed for everyone. UNLESS, there was some way to deploy the credential with the installer so it "KNEW" it already and the user wasn't prompted for one upon opening the document. If someone took the time/effort to mitigate this by opening the xml manually I could track that down via file share permissions and identify who was doing so.
Thanks for the feedback. Maybe we can come up with something which helps you with that.
Regards,
Stefan
ryan.flagler
Lockdown documents are useful but sometimes overkill since they require full-encryption and a password to even read. Could a "weaker" version of lock-down be implemented that does not require encryption?
Example, we have shared but "controlled" documents that have certain tasks and templates in them. They do not contain passwords, but we don't want people to accidentally modify anything in them. Using document lock-down is overkill and requires everyone to enter credentials at least one time to even load the document. Additionally, lock-down puts limitations in place for referencing credentials between the templates contained within it and credentials from parent connections. It's all very cumbersome for our simplified use-case.
Currently, I just set the permissions of the shared file to read-only but then you get errors if you do accidentally hit the save button, and then when I do want to update the file I have to modify it on the share, update, save, re-set it to read-only. Making a simplified lock-down that prompts for a password only when you attempt to save/modify the document would be greatly beneficial.