[aclug-L] Re: WeatherLab virus

[Chris Owen <owenc@xxxxxxxxxx>]

On Tue, 19 Nov 2002, Carl D Cravens wrote:

> On Mon, 18 Nov 2002, Chris Owen wrote:
>
> > Actually the "winning" 100 got a nagging email from us asking them to use
> > the user interface to change their password (even if they "changed" it to
> > what it was before) so we could capture it in plain text.  Not exactly the
> > positive reinforcement you were looking for but we didn't have a lot of
> > other choices at the point.
>
> I'm a bit confused... passwords get encrypted for a reason.  Why did
> you need to store them in plain text?

Well they aren't stored on production machines that way or anything, but
the password needs to get pushed out to many different machines that may
not be using the same type of encryption.  Without the source you really
can't do that.  It just makes generating any type of authentication
information a lot easier if we have access to the passwords.

It also make things like tech support a lot easier if you have access to
passwords.  Being about to print out a settings sheet with passwords on it
is pretty nice.  Explaining to customers that you can't tell them what
their password is because you don't have it yourself is not fun because
they truely don't understand how that could be possible ;-]

Chris

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Chris Owen                ~ Garden City (620) 275-1900 ~  Lottery (noun):
President                 ~ Wichita     (316) 858-3000 ~    A stupidity tax
Hubris Communications Inc ~       www.hubris.net       ~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi