Subject: Re: Concerned about Debug Files

From: Jason Fosback <[email-masked]>
Date: Wed, 14 Apr 93 15:43:59 -0700

> 	Unless I'm missing something; this doesn't seem to be too
> useful, as the number of sites that actually store encrypted passwords
> in /etc/passwd is getting smaller and smaller.  What if a shadow
> passwd file is being used?  Or MIT/AFS Kerberos?  Can pine handle
> this?
> 

Pine is not *actually* using the /etc/password file; I believe they must  
be using something like getpwent(), getpwuid(), or getpwnam().   
Regardless of the system your OS is using, these functions are able to  
access the "hidden" information in the alternative database.

Besides, even on these alternative systems (e.g., NetInfo for NeXT), the  
password information is still accessible by everyone, you just need to  
know how and where to look :) . 

> 	Besides, is it really pine's business to be worrying about
> locking the screen?  There are other program to do this (xlock, etc.)
> 

Yes, it is.  We have a terminal room full of "dumb" terminals here at the  
University of Oregon, and it's an invaluable tool for users that want to  
lock their terminal momentarily.

I have to agree with Mark Crispin's comment about the System  
Administrator's reaction.  The encrypted password is still available to  
the user; one just needs to know where to look (see above).  In fact,  
_everyone's_ encrypted password is available to a user that has  
permission to be on the system.

-jason
_________________________________________________________________
Jason Fosback, User Support Analyst    | No sir, I didn't like it
   ---- University of Oregon ----      |                 -R&S
Internet:  [email-masked] | Star Trek:
NeXT mail: [email-masked] |  The NeXT Generation...