[rescue] two-factor authentication (topic change)

[Gary Nichols]

I've walked into sites where:
1) All machines were ON the internet.  We're talking a router plugged 
into a hub.  You get the picture.
2) Network had the best firewalls, IDS systems and VPN solutions 
implemented -- and the damn sysadmins poked tcp/23 through the firewall 
so they could telnet from home.  UUUUUUUAAAHHHHHHHHHH *slam*slam*slam*
3) Same network as #2 - they had a modem running in AA mode plugged 
into the back of their main AIX box - and when you connected you got a 
shell prompt!  AAAHAHHHHHHHHHHH
4) NT VPN access - accounts had a password of 'password'

Ah, the list could go on and on....

Sometimes being a security guy is a lesson in patience, understanding 
and utter fricking stupidity.


> It's not limited to developers (I am one these days, btw). Some yahoos
> claiming to be SAs because they have scads of hardware running NT are
> working with VPNs over the public internet but only using the single
> shared secret for authentication. *BLINK*