By mistake, I seem to have logged in as another user. I was typing my username, when my finger slipped and I logged in before I had either finished typing my complete username, or any password whatsoever. It seems that the user I accidently logged in as has an empty password. * is this really possible, or have I made a mistake? * if this really is so, this is a moderate-sized security hole, because this has the same dangers as accounts with publicly accessible passwords, which are generally held to be a case for block-on-sight. It would probably make sense to check for zero-length passwords at account creation time, and to scan for zero length and other trivial passwords on existing accounts, if possible, and issue a warning that they will be locked if the user does not change their password after (say) a month. It would also make sense to try to enforce a simple password-checking routine, to make sure that users from now on can only set passwords that are at least slightly stronger than a single dictionary word (two short words are a surprisingly effective measure in terms of bang-per-character). -- Neil