Re: SMC Router safe Login in plaintext

[Paul Schmehl <pauls () utdallas edu>]

--On Wednesday, September 03, 2003 17:14:04 -0500 "C. Church" 
<cchurch () alertlogic net> wrote:
> Did you read what you just said?  How many ISPs have you called where they
> would "Tell you what your password is"?  If your ISP can tell you what
> your password is, let us know who it is, so we can all avoid them in the
> future.
SBCGlobal.net, ATT.net to name two big ones.

> Answer: they don't need to know your old password to change your password.
> It's called permissions, and privileged access.  As root, or a priveleged
> user, I can change anyone's password without having to know the old one.
<sarcasm mode="on">No, really?  I would have never guessed.</sarcasm>

> Think about it.

OK, I thought about it.  Now what do I do?

BTW, when I say "tell you what your password is", what I mean is something 
like this, "Mr. Schmehl, your password is 1234qwer.  Are you sure you're 
typing it right?"

Doh!

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html