Replies

Yes, in both the Windows and Linux cases you need access to the machine. Now that we've gained access to both systems, I am stumped by the Linux box and can get all of the passwords off the Windows box in a few minutes. Now I can access all of those users' files (even encrypted) on that machine and throughout the network, wherever those users have permission.

This is the kind of nonsensical post that I've come to expect from you. Ask any security expert about this issue. If you have physical access to a machine, it doesn't matter which OS is installed: It can be compromised. Complaining that it's easier to get passwords from Windows than Linux is a waste of bandwidth because BOTH CAN BE COMPROMISED. So give it a rest. This isn't a meaningful or honest debate.

Congratulations, you found one. I wonder why the earlier proponent of this hadn't been able to produce it. In any case, it shows that security can be increased (definitely a good thing), but as you know we usually stick to what's in the box, not something I've never seen used, not even in a Top Secret environment.

Sigh. I don't know why I have to keep explaining this for you. You use whatever security is appropriate for your needs. Smart admins don't just use whatever comes in the box. Higher security environments require more stringent protections: smart cards, locked labs, etc. Security requires a tiered approach that encompasses far more than a choice of which OS to use. You should know that by now. Sadly, you're so preoccupied with proving that one or the other is "inferior" that you completely miss the point.

Complaining that it's easier to get passwords from Windows than Linux is a waste of bandwidth because BOTH CAN BE COMPROMISED.

Really, how do you propose to crack a decent Linux password in a short enough amount of time? Owning the computer is one thing, but owning the passwords of possibly several people has implications far beyond that one computer and onto the network.

Sadly, you're so preoccupied with proving that one or the other is "inferior" that you completely miss the point.

Yet it is inferior. Period. You bring other sensible precautions into the mix, but that is outside of the subject that Windows passwords can be easily cracked. It is a tiered approach, and this one tier is inferior unless you use third-party add-ons to make up for Microsoft's lax security.