5

I realise this was somewhat covered previously in this question but this question, which is merely another in a long line of similar ones, prompted me to think that perhaps such questions should be actively discouraged by closing them as off topic. I simply don't believe we should be answering questions that require hacking or other questionable means to solve. If it's a genuine need any half decent admin should be capable of finding a solution on less reputable sites. Opinions?

Update:

At least some think I'm aiming for security through obscurity, which is not what I've said or even hinted at, so I'll try and phrase this a little differently.

It's my opinion that we should not be encouraging the use of tools or methods which we would object to someone using on our own networks/systems.

While password recovery tools are the topic in this case they are only one example, although by far the most commonly requested.

  • its not your duty to be a moral judge, that's g-d's job – l--''''''---------'''''''''''' Oct 27 '10 at 19:56
  • 2
    @I__, it's not a case of being a moral judge. It's really about being professional. The subject of professionalism has been raised on a number of previous occasions and the conclusion I draw from those discussions is that we should eliminate those questions which are clearly inappropriate, which is how I interpret hacking topics. This question is to try and determine whether my views are shared by others or I'm being picky. After all, SF is for professionals, not hackers. There are plenty of other sites that cater to the latter. BTW, religion and religious references are most inappropriate. – John Gardeniers Oct 27 '10 at 21:01
  • @I__, I think every religion that believes in god would disagree, and most would say it's divine inspiration (or design) that gives you the ability to do so. Additionally I know plenty of atheists who would argue that human beings have the innate ability to recognize moral situations, and the duty to do so. – Chris S Oct 28 '10 at 12:49
  • This is about ethics, not morality. I've just checked against my professional code of ethics and found nothing wrong with the answer that I gave; I discerned that it was right to share the knowledge that I had, and I acted impartially. Of course, should the ServerFault community decide that I was wrong, I will accept that. – Andrew Nov 2 '10 at 8:12
  • @Andrew, we do not all live or work under the same code of ethics, or have the same moralities. – John Gardeniers Nov 2 '10 at 11:24
2

I started to say, "I think that recent question you quoted is a legitimate one," but then I re-read it and now I'm not sure.

On the one hand, the reference to going outside the domain sounds legit, but if changing a local password would do what's needed, I'd expect a sysadmin to know how to google "change forgotten windows password"

I'd agree with the idea of closing questions where it sounds like someone looking for help cracking a system, but leaving them open if they sound legitimate.

...And erring on the side of closing.

  • It may be a bad example, as that question may very well be legitimate. However, the answer requires a hack, which is the part I don't think we should be participating in. – John Gardeniers Oct 26 '10 at 22:09
  • 5
    Calling a password reset utility a hack really downplays some of the really cool hacks people have done over the years. – Zoredache Oct 28 '10 at 17:11
8

I just wanted to address the idea of whether or not SF "should or should not" cover password resetting topics. Absolutely yes. It's important, and it's high-value content for that situation where an admin (newbie or grizzled veteran) needs that information. Their Google searches SHOULD bring them to SF for that answer. They can trust the content here - it'll keep them off some trojan-ridden hack site.

The last thing I want, as an admin, is to be blindsided by some user or manager who knows about one of these hacks before I do. Not talking about it doesn't make it less of a danger.

Security through obscurity isn't something that I think we should be adopting as a policy, particularly not on SF. How hypocritical.

That being said, I think sysadmin1138 is 100% right with the One True Password Question response (possibly linked in the wiki for some password recovery/reset tags?) - not to obscure the information, but to keep script-kiddie requests from cluttering the site.

This should probably be a comment, and not an answer. But it's Meta. :P

  • 1
    Interesting point of view. The way I see it that would make SF the go-to site for information about circumventing security systems. Is that really what you want to see happen? My opinion as a professional admin is that we should be taking active steps in the opposite direction, so clearly we have diametrically opposed views on this. Your reference to security through obscurity is lost on me in this case because it isn't a matter of hiding the information. It's about we as professionals not ENCOURAGING hacking by answering questions that require a hacking solution. – John Gardeniers Oct 27 '10 at 21:12
  • I agree entirely, Kara. The ability to test vulnerabilities, among other security topics, is absolutely within the realm of professional IT. Nevertheless, obviously unscrupulous end-users we don't need to cater to. I believe I've written my detailed opinion on this on a different post. – Warner Oct 28 '10 at 13:34
  • 2
    @John Gardeniers, it seems there is a bit of a strawman in your argument here. I don't think we are encouraging hacking, I think we are trying to encourage sharing information that a sysadmin may have to commonly deal with. – Zoredache Oct 28 '10 at 17:20
  • 2
    I think taking questions from script kiddies seriously would be just as annoying as doing kids' homework for them. Though I'd rather err on the side of not throwing out babies with bathwater - more specifically, I still want to encourage students to participate (as they're the next batch of professional users) - just as a lot of dodgy-sounding security qustions may be coming from the next generation of white hats. Naive questions sound pretty similar to malicious questions trying to sound innocent, dont' they? – Kara Marfia Oct 31 '10 at 18:30
  • @Kara, we obviously disagree on some points. e.g. I don't believe SF should be supporting the students or other admin wannabes, as they clearly do not fit the criteria spelled out in the FAQ. Either the site is for professionals or it's not. You can't have it both ways. – John Gardeniers Nov 2 '10 at 22:15
  • 1
    I disagre with the idea that it's beneficial to anyone to attempt drawing this line in the sand, though I respect your inclination to keep things legit. Luckily, the community at large does a good job of voting the worst questions to close. – Kara Marfia Nov 3 '10 at 3:31
8

Those questions tend to attract a certain type of spammer as well. This may be an area where we unofficially declare a certain question as the One True Windows Password Reset Question, protect it, and close the rest as duplicates.

update:

This particular question appears to be a good candidate for what I'm talking about:

Obtaining administrator access to Windows XP (lost password)

  • 2
    You're certainly correct about the spammers. – John Gardeniers Oct 27 '10 at 4:50
  • I strongly agree that we should be closing duplicate whenever possible, particularly for this type of question which seems attract SPAM. – Zoredache Oct 28 '10 at 17:52
8

I might have a problem with someone asking about a previously unknown remotely exploitable vulnerability in really common product like Windows, Linux or something.

I don't see any value in trying to hide information that is extremely easy to be found and is common knowlege to almost every sysadmin. Telling someone that they can use a tool to change the password to a machine if they have physical access really doesn't come close to being something that should or can be suppressed for security reasons.

This is a site for sysadmins, I think we should share any and all information here that a sysadmin may commonly experience.

Having an account locked out is pretty common. Someone at work just managed to need to use this yesterday, when a computer account was deleted when it shouldn't have been, the local admin password was not the standard, and cached credentials where disabled. It is not like a remote exploit, you require physical access to use these tools. Trying to pretend that a user which has physical access to a machine doesn't have the ability to do whatever they are capable of doing to the box is kinda silly in my mind.

On a related point, I am also not that worried about firewall/filter bypass questions which are also somewhat common. Any firewall setup where security matters also will include a good deal of logging of traffic that what was permitted. If someone does get out when they shouldn't their activity should be in a log that is reviewed by the firewall admin anyway.

It's my opinion that we should not be encouraging the use of tools or methods which we would object to someone using on our own networks/systems.

This is a site for system administrators to answer questions for system administrators. Given no evidence to the contrary my default assumption when answering a question is that I am talking to a system administrator who is asking a question about administering a system they are responsible for.

I usually don't want my users to be running nmap, but I am not talking one of my users when I am answering a question here I am talking to a system administrator perfoming their duty.

Following a strict version of your statement I think would mean that we shouldn't discuss anything having to do with any sysinternals tool, regedit, scripting, command prompt, nmap, tcpdump, debugging, running hexedit, etc. If you where to build an exhastive list of all the things we couldn't discuss because it could be abused I think you would find that there would be a lot less on-topic questions left.

I think any type of censoring a discussion about a tool that a system administrator may use in the normal course of their work is silly and counter-productive if we wish to be a good source of questions ans answers for everything sysadmin.

I want system administrators to be properly informed about how to use tools with a potential for destruction. I don't want ignorant sysadmins mis-using a tool and trashing their own network because they don't have a place to discuss th proper usage of the tools.

Answering a question about a sysadmin tool is not mean to encourage abuse. If the question is clearly intend to be about abusing a network instead something may ask then vote to close it as off-topic, downvote it, and/or add a comment to the question informing the asker that you don't think their question is related to system administration.

If a superuser can abuse my network because of something they read here, so what? They could have read about the tool somewhere else and learned the same thing. I don't care about the non-sysadmin user that may read this site. I am here to talk to people interested in system administration.

  • You also seem to think I wish to hide the information, which is not my intention or goal. I simply don't believe we should be encouraging hacking and, like it or not, that is what password recovery is. Whether there is a legitimate need to do so or not is irrelevant. For the record, I have the tools I need to do such things with me at all times but don't believe SF is the appropriate place to discuss them. – John Gardeniers Oct 28 '10 at 21:27
0

I'm torn on this one:

Cons:

  • Admins should know better than to lock themselves out. They have a responsibility to ensure proper security practices, and that should never lead to a "oops, I locked myself out" situation.
  • I'd guesstimate 90%+ of people using password reset utilities are hacking into somewhere they shouldn't be.

Pros:

  • I've had a few users over my career lock themselves out of their home computer and ended up helping them through the process. It wasn't a part of my job; but part of professional courtesy.

Neutral:

  • Having SF come up on Google when people are looking for such utilities would be good advertising for the site. However, see above point about who uses these utilities, and thus the type of people you're attracting.
-1

I agree. Any admin that had been at the game for a while, knows about the change-nt-password utility for local account, and questions re: domain password cracking, need to go.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .