Should we try to eliminate password reset questions?

Question

I realise this was somewhat covered previously in this question but this question, which is merely another in a long line of similar ones, prompted me to think that perhaps such questions should be actively discouraged by closing them as off topic. I simply don't believe we should be answering questions that require hacking or other questionable means to solve. If it's a genuine need any half decent admin should be capable of finding a solution on less reputable sites. Opinions?

Update:

At least some think I'm aiming for security through obscurity, which is not what I've said or even hinted at, so I'll try and phrase this a little differently.

It's my opinion that we should not be encouraging the use of tools or methods which we would object to someone using on our own networks/systems.

While password recovery tools are the topic in this case they are only one example, although by far the most commonly requested.

Answer 1

I started to say, "I think that recent question you quoted is a legitimate one," but then I re-read it and now I'm not sure.

On the one hand, the reference to going outside the domain sounds legit, but if changing a local password would do what's needed, I'd expect a sysadmin to know how to google "change forgotten windows password"

I'd agree with the idea of closing questions where it sounds like someone looking for help cracking a system, but leaving them open if they sound legitimate.

...And erring on the side of closing.

Answer 2

I just wanted to address the idea of whether or not SF "should or should not" cover password resetting topics. Absolutely yes. It's important, and it's high-value content for that situation where an admin (newbie or grizzled veteran) needs that information. Their Google searches SHOULD bring them to SF for that answer. They can trust the content here - it'll keep them off some trojan-ridden hack site.

The last thing I want, as an admin, is to be blindsided by some user or manager who knows about one of these hacks before I do. Not talking about it doesn't make it less of a danger.

Security through obscurity isn't something that I think we should be adopting as a policy, particularly not on SF. How hypocritical.

That being said, I think sysadmin1138 is 100% right with the One True Password Question response (possibly linked in the wiki for some password recovery/reset tags?) - not to obscure the information, but to keep script-kiddie requests from cluttering the site.

This should probably be a comment, and not an answer. But it's Meta. :P

Answer 3

Those questions tend to attract a certain type of spammer as well. This may be an area where we unofficially declare a certain question as the One True Windows Password Reset Question, protect it, and close the rest as duplicates.

update:

This particular question appears to be a good candidate for what I'm talking about:

Obtaining administrator access to Windows XP (lost password)

Answer 4

I might have a problem with someone asking about a previously unknown remotely exploitable vulnerability in really common product like Windows, Linux or something.

I don't see any value in trying to hide information that is extremely easy to be found and is common knowlege to almost every sysadmin. Telling someone that they can use a tool to change the password to a machine if they have physical access really doesn't come close to being something that should or can be suppressed for security reasons.

This is a site for sysadmins, I think we should share any and all information here that a sysadmin may commonly experience.

Having an account locked out is pretty common. Someone at work just managed to need to use this yesterday, when a computer account was deleted when it shouldn't have been, the local admin password was not the standard, and cached credentials where disabled. It is not like a remote exploit, you require physical access to use these tools. Trying to pretend that a user which has physical access to a machine doesn't have the ability to do whatever they are capable of doing to the box is kinda silly in my mind.

On a related point, I am also not that worried about firewall/filter bypass questions which are also somewhat common. Any firewall setup where security matters also will include a good deal of logging of traffic that what was permitted. If someone does get out when they shouldn't their activity should be in a log that is reviewed by the firewall admin anyway.

It's my opinion that we should not be encouraging the use of tools or methods which we would object to someone using on our own networks/systems.

This is a site for system administrators to answer questions for system administrators. Given no evidence to the contrary my default assumption when answering a question is that I am talking to a system administrator who is asking a question about administering a system they are responsible for.

I usually don't want my users to be running nmap, but I am not talking one of my users when I am answering a question here I am talking to a system administrator perfoming their duty.

Following a strict version of your statement I think would mean that we shouldn't discuss anything having to do with any sysinternals tool, regedit, scripting, command prompt, nmap, tcpdump, debugging, running hexedit, etc. If you where to build an exhastive list of all the things we couldn't discuss because it could be abused I think you would find that there would be a lot less on-topic questions left.

I think any type of censoring a discussion about a tool that a system administrator may use in the normal course of their work is silly and counter-productive if we wish to be a good source of questions ans answers for everything sysadmin.

I want system administrators to be properly informed about how to use tools with a potential for destruction. I don't want ignorant sysadmins mis-using a tool and trashing their own network because they don't have a place to discuss th proper usage of the tools.

Answering a question about a sysadmin tool is not mean to encourage abuse. If the question is clearly intend to be about abusing a network instead something may ask then vote to close it as off-topic, downvote it, and/or add a comment to the question informing the asker that you don't think their question is related to system administration.

If a superuser can abuse my network because of something they read here, so what? They could have read about the tool somewhere else and learned the same thing. I don't care about the non-sysadmin user that may read this site. I am here to talk to people interested in system administration.

Answer 5

I'm torn on this one:

Cons:

• Admins should know better than to lock themselves out. They have a responsibility to ensure proper security practices, and that should never lead to a "oops, I locked myself out" situation.
• I'd guesstimate 90%+ of people using password reset utilities are hacking into somewhere they shouldn't be.

Pros:

• I've had a few users over my career lock themselves out of their home computer and ended up helping them through the process. It wasn't a part of my job; but part of professional courtesy.

Neutral:

• Having SF come up on Google when people are looking for such utilities would be good advertising for the site. However, see above point about who uses these utilities, and thus the type of people you're attracting.

Answer 6

I agree. Any admin that had been at the game for a while, knows about the change-nt-password utility for local account, and questions re: domain password cracking, need to go.