Re: V$ tables

They aren't encrypted, they're hashed.

And it is simplicity itself to combine access to those passwords with the alter user command to break into another account, and patch things up afterward so no-one knows you did it.

It's not a view I'd be giving out to the great unwashed.

Regards
HJR "Jim Kennedy" <kennedy-family_at_attbi.com> wrote in message news:qZIO8.206733$cQ3.7109_at_sccrnsc01...
> You can't get the passwords from dba_users they are encrypted.
> Jim
> "ls cheng" <g-e-n-o_at_europe.com> wrote in message
> news:b352e1b3.0206150626.13124e4_at_posting.google.com...
> > There are problems with DBA_ views, you can get the passwords easily
> > from dba_users, you can look the password in db links easily from
> > dba_db_links, you can spool data model from other schemas easily from
> > dba_tables, you can see audit from dba_audit* views etc etc etc. Its
> > about how do you want to secure your database, otherwise these user_,
> > all_ dba_ views would not be seperated
> >
> > Data in data dictionary can get or not very sensitive depending on
> > your environments
> >
> > Regarding v$ views agree that some of them should be avaibale to the
> > developers but I would not say all of them neither.....
> >
> > May be we will agree when someday someone's database is hacked :-)
> >
> >
> >
> > Daniel Morgan <dmorgan_at_exesolutions.com> wrote in message
> news:<3D0A137B.F00D3EC9_at_exesolutions.com>...
> > > Charlie Edwards wrote:
> > >
> > > > Hi,
> > > >
> > > > I would be grateful for a DBA's opinion on this ...
> > > > Which V$ tables should be available to developers as a matter of
> > > > course?
> > > >
> > > > v$process, v$session, v$lock, v$sqlarea, v$sqltext, v$locked_object,
> > > > v$session_longops ...
> > > >
> > > > Any others?
> > > >
> > > > For that matter, is there any reason why developers should not have
> > > > acess to ALL V$ tables in a development environment?
> > > >
> > > > Thanks,
> > > >
> > > > CE
> > >
> > > Please allow me to ask the question in a different way. What possible
> > > justification is there for not giving developers access to all v_$
> > > views? And for that matter all dba_ views too?
> > >
> > > Can they change anything?
> > > Can they do any damage?
> > > Is there a negative side to having developers that know and care about
> > > how their work will impact production?
> > >
> > > Give them the whole darned thing and be glad they asked.
> > >
> > > The only reason I have ever felt for DBAs denying access to the data
> > > dictionary views (other than ego) is that they are so insecure with
> > > their own skills that they are afraid someone might see that they
> > > haven't been doing their job well.
> > >
> > > Daniel Morgan

>
> Received on Sun Jun 16 2002 - 15:27:30 CDT