In a typical home user situation with a PC connected to the internet via a router, suppose we are not concerned with protecting the machine from people with physical access. Does setting a password on a Windows XP user account help secure the machine from remote exploits? (compared to a passwordless account).
With no password set at all, remote desktop access is (should) not be possible. Are there other attack vectors where having a password reduces risk? In short, what is more secure?
No, there is no additional protection against remote exploits, but you should always set an account password wherever humanly possible, for a whole host of reasons not related to remote code execution bugs.
Remote exploits usually result in code execution, and that code would run under the privilege level of the user that was running the exploited service or application. As such, the password mechanism is entirely bypassed.
This is especially the case for services running under dedicated service accounts, such as NETWORK SERVICE, LOCAL SERVICE, or SYSTEM, which don't technically have passwords in the first place - they have NTLM hashes with random values, and login is disabled for them.
The only protection I can see is in a scenario where a low-privilege user (e.g. a limited or guest account) runs an application that is open to the network, and that application is exploited. From there, a passwordless account is a target for horizontal privilege escalation, or vertical privilege escalation if the account runs as administrator.
All in all, I would suggest that a password is always set on all user accounts, but not for remote exploitation protection reasons. There are so many other reasons to set a password.
Well, if you have no external hardware firewall (mostly there is one in the router) and you have file services enabled or things like that, then the remote side could simply connect to your \system\c$ share and place any malware there or whatever. With RPC access the attacker could place things into the registry, etc. If your firewall is blocking that, you're safe against these attacks.
Keep in mind that XP is out of Microsoft support in a few months. That means that if a new remote exploit gets discovered, you won't even get a security bugfix for it.
Are there other attack vectors where having a password reduces risk?
The fleshy things that poke the keyboard are well known to be exceptionally insecure and often are more exploitable than the operating system itself.
Perhaps you should revisit not being concerned with protecting the machine from them, as well as applying principles of least privilege (to the point of having 2 accounts for yourself so you're not admin when you don't need to be.)
