HTML Access Security

[K_Miller]

We are looking into implementing HTML access however we are concerned about users saving their logon credentials in browsers on machines we do not have control over. I would like to know if anyone has dealt with this and how they were able to tackle the issue. Please let me know if you have any insight into this.

Thank You,

K Miller

[vTimD]

Would you be allowing the HTML access from personal computers, or from domain-managed computers? If they are personal computers, you may have trouble trying to control that. If they are domain, you could try and implement a GPO to control that.

[rrr5703]

Along these lines, is there a capability, or a plan to add a capability, for supporting CAC enabled logons for HTML access?

This would be very beneficial for the government user...

[vTimD]

According to the documentation, Smart Card Authentication is not supported with HTML access:

https://www.vmware.com/pdf/horizon-view/horizon-html-access-3x-document.pdf

[rrr5703]

Thanks...  I understood that, but is there any plan to implement it?  Seems like it would make a lot of sense to do so...

[vTimD]

I'm sorry, I misunderstood your post when I read it. As I am not an employee of VMware, I am not really privy to the future road maps. There is a section on the website to make feature requests:

Contact VMware | United States

You should submit it, as it could definitely be beneficial.

[K_Miller]

Yes we would like to allow access from personal computers and by the same token that would open it up to public computers. My concern is that someone would save their credentials in a browser on a public or shared computer. This could result in a lasting security hole.

KM

[vTimD]

I totally understand your concern. This is one of the reasons why we have not rolled out Blast desktops to external users at this point. Saving form data is a native browser functionality, and I don't see any way to control this natively from within View. Unless someone has more info here, I'd open an SR and see if anyone in support or engineering has a solution that could work for this. If you find one, please post it back here, as I am sure you aren't the only and last person to ask about that.

[ifiona]

HTML　Ａｃｃｅｓｓ　ｈａｓ　ｄｉｓａｂｌｅｄ　ｓｔｏｒｉｎｇ　ｐａｓｓｗｏｒｄｓ　ｉｎ　ｔｈｅ　ｂｒｏｗｓｅｒｓ　ｂｙ　ｄｉｓａｂｌｉｎｇ　ａｕｔｏｃｏｍｐｌｅｔｉｏｎ．