Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft plans to kill off NTLM authentication in Windows 11

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#41

Post by pixl97 »

msla wrote: post #37

NTLM is being replaced by Kerberos. Kerberos has requirements about clocks being synchronized such that clock skew will prevent authentication. I rather doubt that Microsoft has made Windows any more punctual about setting its damned clock even if you give it a time server and tell it to set its time from the network. Even if the behavior I observed was somehow rare, there's still the matter of local IT "gurus" needi…

I've always loved that the time set by time.windows.com (I think that's the default that comes with Windows) always seems to be 2 to 3 minutes off the time set by the NTP.org pools. Really easy to get outside of the Kerberos 300 second allowance.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#42

Post by jeroenhd »

IntelMiner wrote: post #35
jeroenhd wrote: post #16

Earlier quoted context omitted.

Microsoft has said the same about SMB2 but people still turn that back on because of old NASes and printers. Most guides for Samba still seem to be written with NTLM in mind. Any Linux/*BSD based consumer NAS may break, as well as many hobbyist NAS setups. Microsoft is right to get rid of these old, vulnerable protocols, but there may still be an impact.

Isn't SMB2 meant to be the "mostly good" one introduced in Vista? SMBv1 was an absolute shit-show. A lot of early devices only supported it using hacked up ancient GPL violating Samba builds

SMBv2 is better but still not great. SMBv3 is pretty good. SMBv1 is a security risk that should've been deleted from the Windows source code long ago.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#44

Post by jeroenhd »

wannacboatmovie wrote: post #23
jeroenhd wrote: post #16

Earlier quoted context omitted.

Microsoft has said the same about SMB2 but people still turn that back on because of old NASes and printers. Most guides for Samba still seem to be written with NTLM in mind. Any Linux/*BSD based consumer NAS may break, as well as many hobbyist NAS setups. Microsoft is right to get rid of these old, vulnerable protocols, but there may still be an impact.

If NAS builders can't cope with this change maybe they shouldn't be in the NAS business.

Many of them probably shouldn't, but if customers buy a new computer and their old workflow doesn't work on the new one, they're going to blame and "fix" the new computer rather than replace additional hardware.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#45

Post by jeroenhd »

MenhirMike wrote: post #28
jeroenhd wrote: post #12

Earlier quoted context omitted.

Don't worry, that printer from 2003 the CEO has an emotional connection to probably requires the entire network to keep NTLM enabled. The moment Microsoft rolls out a "turn NTLM back on" checkbox, the internet will be flooded with "how to fix printer not working on Windows 11" articles that will linger at least as long as the stupid "just disable SELinux if you run into any kind of error" articles are sticking around…

I guess that's why they're killing of third party printer drivers as well: https://news.ycombinator.com/item?id=37473628

They're not killing off printer drivers entirely, but they are moving them to userspace. A good idea that should've been implemented a long time ago, in my opinion, though I suspect printer driver manufacturers would've thrown a hissy fit if they actually did so back in the day.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#46

Post by olyjohn »

josephcsible wrote: post #19

How will file and printer sharing work with computers that are only in a workgroup and not a domain?

Just use OneDrive! You think they give a shit about your local file and printer sharing that is only used by nerds like us?

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#47

Post by jeroenhd »

acdha wrote: post #36
jeroenhd wrote: post #9

Earlier quoted context omitted.

The linked article says Microsoft will offer a setting to enable NTLM again. They only seem to be changing the default for now. My guess is that Windows 11 will disable NTLM out of the box and perhaps Windows 12 will disable it entirely.

What would be nice would be if they could allow it only for RFC 1918 addresses with a IP TTL of one – allow the local doughnut shop to keep their old printer a bit longer with a warning but force slacker corp not to keeping procrastinating.

If this does happen, I wouldn't be surprised if someone would start selling dirt cheap "printer upgrade boxes" in the form of small Linux computers with two ethernet ports (or maybe a USB port and an ethernet port, and a WiFi access point especially for the printer) that just run Samba. If the printer is directly attached to the box, they wouldn't even introduce severe security vulnerabilities.

Hell, this could be sold as some kind of firewall solution with a $3/mo "enterprise" subscription. Someone can make money with this!

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#49

Post by bafe »

acdha wrote: post #30
philipov wrote: post #27

Earlier quoted context omitted.

To be fair, finding a good printer is hard. Mid-range enterprise printers manufactured before 2006 are in great demand, because of the progress of enshittification by the industry.

Or you can buy a Brother and spend your time on anything else. Let markets do their thing!

I can concur. My four year old brother MFC works like a charm. Every part is easily accessible and it works on the network without any issues

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#50

Post by wtallis »

jeroenhd wrote: post #5
gmiller123456 wrote: post #2

Is this going to break things like SAMBA?

Samba has supported Kerberos for a while. I'm sure there's some IoT shit that will break with NTLM disabled, but I believe maintained servers shouldn't be impacted.

Doesn't Samba only support Kerberos as part of a full Active Directory deployment? Switching to Kerberos authentication is not just a matter of flipping a switch, it drastically raises the minimum required infrastructure.
Post reply on HN