Even, worse, if the password is used by the legitimate owner, it can be 'sniffed' off the network. There are a number of powerful, easy to use, and free sniffers on the Internet. The potential hacker simply installs the software and 'listens' for user Ids and associated passwords to flow through the network. Another common method of compromising a system that is protected by well managed and implemented password systems is to compromise the passwords stored on a system. Systems that utilize common methods of password control must store the correct password on the system in order to compare it against that password presented by the user.
Hackers can get passwords that are stored on the system.
There are many exploits available on the Internet to enable the cracking of password files. Once cracked, the passwords stored in that file are vulnerable to misuse. There are different approaches available to implement one-time passwords. Originally developed at Bellcore, it is available at their ftp site or a successor OPIE is available from the NRL FTP site. The output is saved on the server to use in future access attempts.