How Secure Is User Password Protection?

Question

I was recently reading this testament to using BackToMyMac
http://community.livejournal.com/macosx/5713803.html
In it the guy describes tracking a thief who stole a MacBook by remotely logging into his user account and getting a lot of info before the thief figured out how to delete his user account.
What concerns me is the guy reports that at some point, the thief was able to change the Admin account. That is most disturbing. I know that in order to change the user account, I need the Admin password, either to add or delete a user account or even make changes to the Admin account.
I can only assume that the stolen MacBook's password was pretty weak and the guy spent hours trying to crack it. Does anyone know, is there any other way to bypass Admin. features to create a new account, or delete other accounts?
At present I have my MacBook set up to require password after sleep or restart. Are both equally secure? Is requiring a password after sleep as secure as logging out? Is there anyway to boot into a useable account without wiping the Mac and doing a complete system install?
If no, then it would seem the weak link is the password and I should choose a complicated one. Does Leopard offer the same functionality that iPhone does, i.e. if one fails to enter the proper password 10 times in a row, it wipes the disk?

Answer 1

Klaus1 wrote:
The second best security measure is to not connect to the Internet.
You are correct.
Many companies do this. They only have one machine directly on the internet. And access to that machine is highly restricted.
Back in the early days of online networking, there were only private networks, CompuServe, MSN, AOL etc. They were only accessible via a direct phone dialup and there way no TCP/IP involved. There were some pseudo-nets such as Telenet (not telnet), Tymnet and others. CompuServe was also reachable via Telenet. Speeds were slow and logging on was arcane and cryptic. One needed to know the bit-length and parity (odd, even, none) of the provider's link etc. Speeds of 9600 b/s were considered perfection. With such slow speeds, hacking would be very obvious.
MCI-Mail was free and they actually sent a real physical letter if the recipient did not have an MCI-Mail account.
The internet ended all that, and we now share our computers with billions of other people each time we log on.
While what goes on on "24" is probably over-the-top, the fact is that much of our infrastructure is now on the internet, as is much of our military. It's almost as if we are asking for or courting disaster.