With this restricted access to the encrypted passwords, an attacker cannot decipher the password with a program that simply cycles through all possible or likely passwords. It is still possible to guess passwords by repeatedly attempting to log in to an account. If the password is trivial or is infrequently changed, such attacks may easily succeed. The login user ID allows the system to trace all user actions to their source. After a user logs in to the system but before running the initial user program, the system sets the login ID of the process to the user ID found in the user database.
All systems are vulnerable if terminals are left logged in and unattended.
The most serious problem occurs when a system manager leaves a terminal unattended that has been enabled with root authority. In general, users should log off any time they leave their terminals.