[Southack]

"Well, yes. Physical access to any machine is pretty much the same as complete access. Mostly."

I don't see it, even with the "mostly" caveat tossed in.

How many people, given full access to an ATM or POS terminal, could debit the accounts of other bank customers?

You see, **security** is more than just protecting a machine's physical access. Good security will survive even with a machine physically compromised.

[chuckles]

I don't know about 2000 or XP, but in 98 you just boot from a floppy and delete all *.PWL files and then reboot with your own PW. I can't see why NT based OS would be different.

[Ramius]

How many people, given full access to an ATM or POS terminal, could debit the accounts of other bank customers?

An ATM or POS term doesn't give you access to the machine. Can't reboot it from there to another system, yadda yadda yadda. But can you say the same thing for somebody that has access to the *inside* of the ATM??

*That's* access.

[cspackler]

"Well, yes. Physical access to any machine is pretty much the same as complete access. Mostly."

"I don't see it, even with the "mostly" caveat tossed in."

If you can get physical access to a windows machine, there are some cute tools to crack every password on the system. The only guard against these is to enforce complex passwords that have no patterns. Simple passwords can be cracked in seconds, complex take forever. The beauty of Windows...