Full Disclosure mailing list archives
Re: SMC Router safe Login in plaintext
From: KF <dotslash () snosoft com>
Date: Thu, 04 Sep 2003 19:31:18 -0400
I know when I worked for an ISP it was certainly not like that... their system ran off some sort of unix box using pppd. All their passwords were in etc/passwd and shadow with the rest of em.
Can't say I remember telling anyone their password either. We would happily reset them for you if you forgot yours (after you gave something like a social sec number as identification and verified as much info as possible). This sort of thing was done through a front end that the admin had coded up....
no clear text passed just laying around though. heh.oh yeah Paul do you wanna tell me some of your throwaway passwords. =]
-KF C. Church wrote:
Every ISP I've ever dealt with stores your password in plaintext. If this were not true, they would not be able to tell you what it is. Just call support, identify yourself and ask them to change your password for you.*shaking head in disbelief* I've worked for numerous ISPs and not once did _any_ of them ever do anything as _stupid_ as storing a list of their customers' passwords in plaintext. (Of course, I'm sure there are a few who lack the foresight to see the eventual breech of security, but those tend to go out of business pretty rapidly.) Did you read what you just said? How many ISPs have you called where they would "Tell you what your password is"? If your ISP can tell you what your password is, let us know who it is, so we can all avoid them in the future. Answer: they don't need to know your old password to change your password. It's called permissions, and privileged access. As root, or a priveleged user, I can change anyone's password without having to know the old one. Think about it. !c _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- SMC Router safe Login in plaintext Florian Rock (Sep 03)
- <Possible follow-ups>
- RE: SMC Router safe Login in plaintext Schmehl, Paul L (Sep 03)
- RE: SMC Router safe Login in plaintext Nathan Rotschafer (Sep 03)
- Re: SMC Router safe Login in plaintext Kim Scarborough (Sep 03)
- Re: SMC Router safe Login in plaintext C. Church (Sep 03)
- Re: SMC Router safe Login in plaintext KF (Sep 03)
- Re: SMC Router safe Login in plaintext Jeremiah Cornelius (Sep 03)
- Re: SMC Router safe Login in plaintext Irwan Hadi (Sep 04)
- Re: SMC Router safe Login in plaintext KF (Sep 04)
- Re: SMC Router safe Login in plaintext morning_wood (Sep 04)
- Re: SMC Router safe Login in plaintext Paul Schmehl (Sep 03)
- Re: SMC Router safe Login in plaintext Justin (Sep 04)
- Re: SMC Router safe Login in plaintext Nicolas Couture (Sep 05)