OTM 6.0 coming soon

We are planning to release OTM version 6.0 soon.
It will include exciting new CAT integration features and more...

For latest news, please follow us at Twitter

Follow @LSPnetwork

OTM on mobile devices – improvement

When you log in to OTM on your iPhone or iPod, now you can decide whether you want to use the (limited) iPhone view or - for full functionality - the browser view. OTM on the iPad opens in browser view automatically.

Works with most Android smartphones  and tablets as well!

For more information about using OTM with smartphones, please click here.

OTM customer communication – Polish added!

The OTM modules for customer communication have been localized in a number of languages: English, German, Spanish, Catalan, French, Dutch, Portuguese and Finnish. 
Now we added Polish to the client interface.

Customer and resource log-in for your web site

You might want your customers to log in to their OTM service pages directly from your web site. Here's the HTML code:

<form action="https://subdomain.qtn.net/customers/index.php" method="post"> Username: <input name="login" type="text"> <br/> Password: <input name="pw" type="password"> <br/> <input style="display: block;" name="submit_bt" value="Log In" id="loginbutton" type="submit"> </form>


Here is how it works with the resources' log-in:
<form action="https://subdomain.qtn.net/resources/index.php" method="post"> Username: <input name="login" type="text"> <br/> Password: <input name="pw" type="password"> <br/> <input style="display: block;" name="submit_bt" value="Log In" id="loginbutton" type="submit"> </form>

Please replace subdomain with your OTM subdomain.

OTM <––> SDL Trados

As of the fourth quarter of this year, OTM will actively support project work with SDL Trados Studio.

LSP.net is currently developing a software module (middleware) which is installed on a user’s workstation and makes use of the interfaces for OTM and SDL Trados. The data connection to OTM are certified and securely encrypted.

Projects designated as “Trados projects” in OTM will be downloaded via the software module and automatically checked for SDL Trados compatibility. If the check is successful, the data are sent directly to the translation environment tool. Translation memories can be used or added.

The Trados analysis logs (together with the project packages) will be sent back to OTM via the middleware. Configurable weighting values for evaluating the log data are stored in OTM.
With just a few clicks, the project manager can convert the data from the analysis to corresponding quotation items in OTM. Various formats can be selected for the quotation.

The process for creating a job in OTM to pass the data on to the translator is similarly convenient.

The new software module simplifies working with Trados projects considerably and will be available by the end of the year through the SDL Open Exchange or directly from LSP.net. The price of the module has not yet been determined.

OTM® is a registered trademark of LSP.net
SDL TRADOS® is a registered trademark of SDL

Major improvements in OTM security

Up to now, passwords in OTM have been stored in the database with encryption corresponding to the usual Internet standard, a cryptographic hash function similar to the MD5 message-digest algorithm. As a consequence, even if an intruder manages to access the list of passwords, these cannot be used. Hash codes require considerable can be effort to break – as long as the password is “secure”. A password like “amadeus” is not secure, because it can be decrypted easily using a dictionary attack. (“Dictionary” in this context refers to a list of previously identified passwords.) So in this case, security really does depend on the user.

We have changed this procedure for two reasons. First of all, it is important to minimize the dependence on the user. In other words, an encrypted password stored in the database should remain “unbreakable” even if it is not secure (such as in the case of “amadeus” mentioned above). Secondly, the rapid development of greater technical capacities by hackers - using specialized hardware, Cloud computing and improved methods - is a source of increasingly deep concern. The dictionaries available for such attacks are also constantly increasing in size and now comprise billions of compromised passwords. Thus even passwords previously considered secure, such as “Iwab033yrsB4” are no longer sufficient for higher standards of security.

The technical reason for this, to put it simply, is that the code generated during hash encryption (the “hash”) is too short. It comprises a mere 16 hexadecimal characters. Such code might look like this: 3dd891646eab094f. One character can assume 16 different values (0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f). This results in 18,446,744,073,709,551,616 possible codes. That sounds like a lot, but it’s not enough to defend against high-powered computers and dictionary attacks. Though not all hashes and their associated passwords can be stored in a dictionary, because this would make it quite enormous, but if a password is listed in a dictionary, it can be compromised in seconds, enabling the attacker to log into the system. There is an underlying issue to cause even greater concern: this huge number of possible hash codes is actually not a problem any more for specialized hardware or networks of computers today. According to the latest estimates, a brute force attack on a specific password (meaning the rote, systematic attempt of all possible combinations until the password is “cracked”) would take about four days with the right equipment. This is completely unacceptable, of course. The security of encryption methods rests largely on the fact that guessing takes too much time for an attacker. The used algorithm is simply too efficient. Calculating the hash value does not take long enough.


Therefore, we have improved OTM security on three levels:

• The length of the hash code stored was increased to block dictionary attacks.
• Password security no longer depends exclusively on the user’s entry.
• A more cumbersome cryptographic method is now used to cause delays to make brute force attacks ineffective. 

>> The change poses no problem for OTM users, as there is no compulsion to create new passwords.


Our method comprises the following: First, the password entered by the user is recoded to the previous hash value by the old method. This hash is then extended with a secret, long character string (referred to as salt). Then this extended character string is encrypted with the SHA256 method and compared with the entry (already converted by us) in the database. If the comparison shows a match, the password entered was correct. Otherwise not.

Thus the user can continue to work with the old password, because we can already convert its old hash value to the new value in the database even if the actual text of the password is not known. The salt makes the database hash value independent of the complexity of the user’s entry. Altogether, the method slows the process quite a lot, though not in a way noticeable by the user, because it is only a matter of milliseconds. But for an attacker, this difference makes a brute force attack pointless. Instead of taking days to break a password, the thousands of billions of iterations required would add a century or so to the time needed for a successful attack. Moreover, the hash value saved is no longer a mere 16 characters, each with 16 possible values, but rather 64 characters with 16 values. This translates to 1.1579208923731619542357098500869e+77 possible values for the hash code. No dictionary attack can cope with numbers of that magnitude. Thus all three points of possible attack have been reinforced, dramatically improving password security.

The changes will take effect with the OTM version 5.6.5 update.


-----------------------------
For more information on the above topics, please click the following links:
MD5: http://en.wikipedia.org/wiki/MD5
Salt: http://en.wikipedia.org/wiki/Salt_%28cryptography%29
SHA256: http://en.wikipedia.org/wiki/SHA256
Dictionary attack: http://en.wikipedia.org/wiki/Dictionary_attack