Thank you for the information. I thought the security issues were more fundamental. For example if my database has remote os authentication (with prefix OPS$), and I know that there is a user called OPS$JSTILL, then I can change the Windows Registry on my client to enable me to logon to the database as OPS$JSTILL.
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
>
> At one time you could set the 'ORACLE_USERNAME=SYSTEM'
> variable in your
> oracle.ini
> file, and log into any database as SYSTEM ( without a
> password ) as long
> as REMOTE_OS_AUTHEN=true.
>
> That was obviously some years ago, and I don't know if that is still
> possible.
>
> I would have hoped that such an obvious hole was plugged
> years ago. It
> seems to
> me that it was, but I don't recall details.
