@tylerl Please, back that claim of yours. You "see a number of edits like this", and "adding a space". I'd like to see links so I can provide proper explanation, since "you'd love to hear why".
@AviD Not at all, I know for a fact that I have two space-only edits (I think "the number" @tylerl is talking about), and the reason is because I changed my mind and I wanted to reverse/remove my vote after the grace period.
@kalina No, I change my mind about votes because, well, people change their minds depending on new inputs. There might be something in the post that I didn't see before, and now I see it.
@Adnan I've seen about 4 edits that seemed unusual, and I couldn't see why you would take the effort. Not trying to start a fight; just wanted to understand the reasoning.
@ThomasPornin I deliberately chose cockroaches for their radiation resistance. The voting lock doesn't really prevent tactical downvoting, but causes lots of collateral damage.
I'm sure I've expressed this before, but is anyone else ever frustrated when they have a question reach "Popular Question" (1,000+ views) status while having a vote rank of <10?
@Seth Ah, thanks for that. Generally, I try not to take offense with certain language - especially in here - but there were just a few too many f-bombs being dropped in the transcript, with apparently hostile intent, for my liking.
@RhysW Well, I was the one teaching the lesson, but yeah. Got a call "my server is down" .. check the netstat ... that's strange, why all this traffic from 84.240.30.56? "OK, server's up again"
@AviD Re "Still secure, though, since you obviously know the password..." umm, no? Having knowledge of the username and password in this particular case does not necessarily imply that an individual knows this is the correct username and password for a Domain Admin account.
@Iszi I remember reading an in-depth risk analysis of this, how the domain identifier not being part of the security identifier is not a security hole, but I really dont remember where.
@AviD Not necessarily. Consider the rare edge case that a Domain Admin account having the same username & password as a Local Admin account on a non-joined system is a complete coincidence to which neither the Domain Admin nor the owner of the non-joined system are aware. How is this not a hole?
(Putting aside the fact that password selection should be random and/or complex enough as to nearly guarantee collision avoidance.)
@AviD That's not a problem at all, but allowing that local admin access to the existing domain just because his UN & PW happen to match (without actually prompting him to log in to the domain) is.
If you're authenticated to a system as YourLocalSystem\YourUsername, you should not be able to automatically use that token to log into my domain as MyDomain\YourUsername.
Well colour me confused.. Firstly the SIDs are different, secondly the usernames are also different. A fully qualified username "LocalPC\User" is not the same as "Domain\User" because they have different scopes.
@David You're thinking like I'm thinking. But in practice that's not the case. If you're logged into LocalPC as LocalPC\User, and you have the same password as Domain\User, you can automatically authenticate to any domain system as Domain\User (without being prompted) even if LocalPC is not joined to the domain.
@AviD At the very least, the fact that the system requesting authentication is not joined to the domain should be a red flag.
Indeed. e.g. "As further evidence that a SID isn’t sufficient, remember that built-in accounts like the Local System account have the same SID on every computer, something that would be a major security hole if it was."
I am almost 100% certain that the answer will be "no", because your local user is not the same as the domain user. The names are different (when fully qualified) and so are the SIDs.
it is actually a well known technique, to set up a local user with the same password as an account in the domain. Useful for e.g. authenticating from a non-domain webserver in the DMZ, to a backend domain database.
"Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one another, even though they may not be intended to have the same privileges.
Example:
Say we have a standalone PC, not joined to any domain. The PC i...
@Iszi two nitpicking points: your question applies even for a non-admin (your question is phrased that way, but the example might cloud the issue), though of course the admin situation is much worse; and you might want to note that this is also true if the unattached "rogue" PC is in fact another domain by the same name.
@Simon Somehow i doubt that. Even if i wanted to i highly doubt there are any nearby. Maybe boston, definitely New York, but i don't want to drive that far.
@Simon I mean sure, i go to a local diner with some friends to study, but i think my brain might explode if i was in a big enough group of people. I would end up finding a corner to isolate myself in an enjoy the music.
And then it would be born. Hopefully with the body of a ram and the vocal cords of a howler monkey. It could get kinda weird, like a monkey with a ram's horns, or a ram with opposable thumbs.
"Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one another, even though they may not be intended to have the same privileges.
Example:
Say we have a standalone PC, not joined to any domain. The PC i...
