yeah we had to sniff the password hashes for customers.. and then we
had to do this for a couple of hundred clients-- so that we didn't
force them to reset their password
not rocket science.
databases can make pretty easy work of it
but it's not practical.
being able to take a server home-- and use brute force and a year to
crack my password:
a) i'll have changed passwords by then
b) you still get a bunch of candidate keys... if you get a hit on my
hash; and you try 10 of them; then you have a trail of failed logons
c) this doesn't mean that Windows NT authentication in a typical
network setup is 'impossible to secure'
Windows NT authentication is _WONDERFUL_ in SQL Server.
and _NO_ it should not be the single logon method for windows apps--
but altogether it is pretty powerful; pretty secure.
I just can't stand SQL Authentication.
70% of the clients I've had in the past 10 years use SQL
Authentication.. that is just flat out ****ing ridiculous.
I wish that everyone used mySql-- then you could secure it so that
you're only getting hits from a particular IP address.
it makes a lot of sense; they should really duplicate that
functionality in SQL Server.
-Aaron