Path: csiph.com!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!eternal-september.org!.POSTED!not-for-mail From: Anton Shepelev Newsgroups: comp.databases.ms-sqlserver Subject: Re: Determine what password is used during a login attempt Date: Thu, 6 Mar 2025 13:35:18 +0300 Organization: A noiseless patient Spider Lines: 34 Message-ID: <20250306133518.75149761831624191f3d21bd@g{oogle}mail.com> References: <20250305142848.fc47cf2469d2b8e8a1b6675d@g{oogle}mail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Injection-Date: Thu, 06 Mar 2025 11:35:23 +0100 (CET) Injection-Info: dont-email.me; posting-host="b9515c2948ff43ae875e80ba7a48b143"; logging-data="3097178"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/Yy2vVlOUqCn34AhV4ZrvL1bvUFkht3Gs=" Cancel-Lock: sha1:e7XXE/T0K033Gc6t9j8HCG3+POw= X-Newsreader: Sylpheed 3.7.0 (GTK+ 2.24.30; i686-pc-mingw32) Xref: csiph.com comp.databases.ms-sqlserver:2264 Erland Sommarskog to Anton Shepelev: > > Hello, all > > Yeah "all", it's soooo crowded here. :-) According to the statistics, it is quite crowded -- 100% of questions in this newsgroup receive a meaningful answer from an MSSQL expert. How many forums can boast of that? You could mention this group in the SQL section of your website, or in your contacts, to remind the readers that Usenet lives on. > > Is it possible determine the password it tries to use, > > if we have full admin access to that database (and the > > entire server) under the 'sa' user? > > No. It's an encrypted hash. If it was reversible that > would be a major security issue. So, only password hashes are sent from client to server? Makes sense. I had a withering weak hope, however, that a complete administrator access to the server would let me do something about it. We all wish security were weaker when dealing with the aftermath of bugs or poor work discipline, and wish it were stronger every time our system was hacked and encrypted by ransomware. -- () ascii ribbon campaign -- against html e-mail /\ www.asciiribbon.org -- against proprietary attachments