31–40 of 86 posts
Earlier quoted context omitted.
To be fair, finding a good printer is hard. Mid-range enterprise printers manufactured before 2006 are in great demand, because of the progress of enshittification by the industry.
Or you can buy a Brother and spend your time on anything else. Let markets do their thing!
So for the uninitiated, what was the issue with NTLM that makes everyone happy they're switching to kerberos?
- NTLM doesn't sign packets. If you can intercept an NTLM auth request you can forward that authentication attempt to another resource and impersonate the user without needing to know or crack their password. You simply MitM the challenge-response between the client and the server. This is called NTLM relaying and is a core issue of NTLM, though some protocols have additional verification such as SMB signing, which is not enforced by default.
- NTLM has relatively weak hashes, though this is far from the biggest issue with NTLM.
- NTLM (unlike Kerberos), uses a single hash for all authentication. If you can compromise this hash, you can impersonate the user anywhere. With Kerberos, each auth event generates a signed with a narrow validity period that grants access to a tuple of user, device, and resource. Meaning if you compromise a user's Kerberos tickets, you can only impersonate them on services that they already had a ticket for at the time, and for only a few hours in until those tickets expire. The NTLM hash itself is the proof-of-identity for all NTLM auth, and this can be recovered in memory or on disk for local accounts.
- NTLM, combined with older broadcast name resolution protocols (namely LLMNR, NBT-NS mDNS, and WPAD) can be very easily intercepted and abused for NTLM relaying due to the lack of signing. It is trivial in most Windows environments to run Responder.py and get an administrative session on pretty much everything. Unless the enterprise has taken steps to harden against NTLM relaying (which is difficult both for compatibility issues and the sheer number of required changes), they're going to be vulnerable to it. My current environment has top of the line network monitoring, SIEM, and EDR, but it's still very easy to slip under the radar with NTLM relaying if you know what you're doing.
So for the uninitiated, what was the issue with NTLM that makes everyone happy they're switching to kerberos?
There’s a long history here:
https://en.wikipedia.org/wiki/NTLM
The main problem is that there’s no way to reliably patch old stuff. If you have a large network, leaving NTLM enabled means attackers will continue to exploit it but as long as it’s an option slacker enterprise IT departments and vendors will continue to delay replacing it. Microsoft deprecated the protocol more than a decade ago so now they’re forcing the slackers to actually do it.
Earlier quoted context omitted.
No. NTLM is an ancient protocol that dates back to Windows NT 3.1 in 1993. That's thirty years ago. Microsoft has been actively telling customers to "please stop using this" for over 10 years. Enough time has passed. NTLM is the Telnet of file sharing. There was a time and place for it and that time has passed.
Microsoft has said the same about SMB2 but people still turn that back on because of old NASes and printers. Most guides for Samba still seem to be written with NTLM in mind. Any Linux/*BSD based consumer NAS may break, as well as many hobbyist NAS setups. Microsoft is right to get rid of these old, vulnerable protocols, but there may still be an impact.
Earlier quoted context omitted.
Like just about every home NAS in the world. Wonder what’s going to happen there?
The linked article says Microsoft will offer a setting to enable NTLM again. They only seem to be changing the default for now. My guess is that Windows 11 will disable NTLM out of the box and perhaps Windows 12 will disable it entirely.
Kerberos has requirements about clocks being synchronized such that clock skew will prevent authentication.
I rather doubt that Microsoft has made Windows any more punctual about setting its damned clock even if you give it a time server and tell it to set its time from the network.
Even if the behavior I observed was somehow rare, there's still the matter of local IT "gurus" needing to punch holes in firewalls sufficient to enable NTP and/or being punctual about setting clocks.
This is going to be fun.
Is the future of windows only online?
Windows 365 (enterprise) is actually really nice. I started using it to manage an org transition @ work, but I am thinking I might also set up a personal instance at this point. The dream is to throw away 100% of my desktops and run with just a MacBook and a decent external monitor. I don't have the patience to manage hardcore/gamer hardware anymore.
Earlier quoted context omitted.
To be fair, finding a good printer is hard. Mid-range enterprise printers manufactured before 2006 are in great demand, because of the progress of enshittification by the industry.
Or you can buy a Brother and spend your time on anything else. Let markets do their thing!
Earlier quoted context omitted.
I'm wondering about Sonos v1 systems. They require some ancient login protocol from the server (NTLM v1?) that breaks every year or two. Sonos will never update their system to modernize it. The dumbest thing is it's just read only access for effectively a public account.
> Sonos will never update their system to modernize it Why not?