How secure are my windows passwords?

I just stumbled upon this Guide for cracking Passwords, through a reference on heise.de.
As you might know, passwords are most of the time (hopefully) not stored in clear text, but in the form of one-way hashes. Thus, even if an attacker got hold of a complete copy of the user data (username + password), this does not automatically mean he will be able to access the user's data immediately.
Hash-Functions, to be secure, have to have the property that it is difficult to determine to a given hash(x) one possible x. Some hash-functions however, are a little weak, at least they become weak as the computational power of PCs grow.

For short passwords, Windows (before Vista) seems to store such a weak hash-value. The Guide above has links to the Windows articles showing how to deactivate this behavior. Also, the Guide gives a way for encrypting the hash-file, making things a little more complicated for the potentiall attacker.

Anyway, the truth is: no one actually ever needs your windows password to access your data. If someone has access to the pc, he/she can just boot it from a Boot Disk and access any data that is stored on the hard drive. Since cracking the passwords as described above would need access to the PC, we can assume the attacker has that access. In such a case, it is much easier to just bypass the OS and boot from a CD. The only protection against this is encrypting the hard drive, and/or setting up a BIOS password. If you lose your password, however, you will lose your data (in case of the encrypted hard drive) or your laptop altogether (in the case of PC, the BIOS password can be reset, but it's a hassle). Also, if only using BIOS password, you data could still be read by stealing the (non-encrypted) Hard Drive.


Another easy way to get access to a windows account described in the guide above, is to reset the account's password (which is far easier than cracking it). There are programs which can do this, see the guide for details. The good message about this is, you can reset your password if you have forgotten it! Plus, if someone did this to you, you would be able to realize there was an attack.

I also found a link about hard drive password protection (which is not like Encryption, but like the BIOS-Password) here.