Tag Info

I'm going to approach this from a Windows domain perspective. If I'm an attacker, I don't care what the usernames are. I simply want them. So I'm going to look for a system that doesn't have RestrictAnonymous, or a Windows 2000 system, and I'm going to scan for all the usernames in the domain. Or I'll gain a single valid user account on the domain and then ...

anonymised user names are another example of security by obscurity. By anonymising the username it makes it difficult for a would be attacker to guess it, from say an email address. Exchange for example often uses the users username as part of the email address. As you stated you have a lockout policy in effect then you already have some method of security ...

Security and Usability must constantly be balanced against each other. This would improve security against a brute force or username guessing attack but makes life far more difficult for the users. The user must now remember 2 pieces of (to them) random information to be able to log in and perform their job functions. This is a risk to the business as the ...

They also can be of use in masking data between employees. People writing reports for payroll etc don't see exactly who is making what. Other situations where if management is choosing layoffs and data on employee performance is presented with anonymous usernames can't be accused of picking and choosing. Random things like that. It makes a bigger ...

All sorts of things -- what OS your machine (or router -- whatever's directly connected to that IP address) is running, what services might be running on there, anything that can be determined by talking to the services provided on that IP address (Windows file sharing is the best one, but even a mailserver or FTP server can provide all sorts of info). More ...

There's a big dislike of "open proxys" as the one you're looking for due to the all the bad things you can do with them, if you want to surf the web anonymously you can always install a Tor Client, check http://www.torproject.org/ to download it.

Working for a .EDU this has come up, but not for security reasons. Like many, we base our usernames (still stuck on 8-character limits due to the presence of older Solaris servers in our user's environment) on the real name at time of registration. Since we have between 19,000 and 23,000 active students at any given time this is done by an algorithm, so ...