Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft plans to kill off NTLM authentication in Windows 11

bleepingcomputer.com

Post reply on HN
Print view View original

61–70 of 86 posts

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#61

Post by WorldMaker »

jeroenhd wrote: post #54
WorldMaker wrote: post #51

Earlier quoted context omitted.

They tried in Windows 8 and printer driver manufacturers did throw a hissy fit. It was one of the big propaganda sources for "UWP is terrible" discourse because UWP gave the best printer experience for userspace printer drivers and that was Windows 8's carrot incentive to try to get the driver writers to upgrade. Rather than accept the carrot most of the driver writers jumped straight into "UWP is bad and no one want…

Windows 8's implementation of UWP was shit for most use cases, though. Desktop users and full screen touch interfaces just don't mix.

I greatly disagree, personally. I don't think enough desktop users gave it a chance. It certainly didn't help that good differentiating features like the better printer stack were just about murdered in their crib.

I still think there was a lot of missed opportunity in Windows 8's implementation of UWP and still wonder what might have happened had it been given more time to iterate and more time to showcase its good sides.

(Also, Fitt's Law suggests that what's good for the touch goose is great for the mouse gander. Carefully thought out "touch screen-first" interfaces can be amazingly friendly to mouse users. Desktop users have become obsessed with reducing things down to the FPS equivalent of a "headshot" target area and have forgotten what early 640x480 Windows was like when even 32x32 pixel targets were the relative size of a barn door and much friendlier to newcomers, tired eyes/arms, and anyone in some state of different ability.)

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#62

Post by jiggawatts »

opan wrote: post #59
josephcsible wrote: post #19

How will file and printer sharing work with computers that are only in a workgroup and not a domain?

Windows has an ssh service you can enable now, so you can get sftp going easily enough for file sharing.

Do you hear yourself?

This is like someone asking for Linux scripting advice and being told that there is VB Script for Linux now!

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#63

Post by jiggawatts »

bodeadly wrote: post #52
tg16 wrote: post #32

Earlier quoted context omitted.

I'm a Security Architect dealing with the pain of an old environment with a default NTLM configuration so i'll chime in: - NTLM doesn't sign packets. If you can intercept an NTLM auth request you can forward that authentication attempt to another resource and impersonate the user without needing to know or crack their password. You simply MitM the challenge-response between the client and the server. This is called N…

This is not accurate. NTLM provides signing and sealing using a session key. It is the responsibility of the protocol using NTLM for auth to use that key to sign or seal. The problem is that this feature is frequently turned off. So it's actually not accurate to say "NTLM is vulnerable to relay attacks". If someone turns off signing in SMB to improve performance, that is not a problem with NTLM, that is a problem wit…

You admit yourself that the defaults are bad.

Because the defaults are bad, vendors have the ability to ship products that are insecure but will still work on a default / typical network.

Administrators have to make risky changes with complex monitoring systems in place to tighten the security to a reasonable level.

The larger the network the harder this is, to the point where it becomes impossible because there are too many incompatible devices.

This is the criticism of the protocol: it not only leads to a pit of failure from which each customer has to dig their own way out.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#65

Post by drdaeman »

stevehawk wrote: post #39
acdha wrote: post #30

Earlier quoted context omitted.

Or you can buy a Brother and spend your time on anything else. Let markets do their thing!

Brother recently adopted the same anticonsumer tactics as everyone else

Can you tell more, please? I missed those news.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#66

Post by lp0_on_fire »

jeroenhd wrote: post #12
gustavus wrote: post #8

I felt a great disturbance in the force as if thousands of pen-testers and grey hats cried out in agony as their go to means of breaking enterprise networks was lost.

Don't worry, that printer from 2003 the CEO has an emotional connection to probably requires the entire network to keep NTLM enabled. The moment Microsoft rolls out a "turn NTLM back on" checkbox, the internet will be flooded with "how to fix printer not working on Windows 11" articles that will linger at least as long as the stupid "just disable SELinux if you run into any kind of error" articles are sticking around…

I jest…but I have an emotional attachment to my HP 4000 LaserJet.

She might be a little slow to print, she might only speak PCL 5, she might have an external usb jet direct adapter…but she prints every time and never jams.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#67

Post by cryptonector »

josephcsible wrote: post #19

How will file and printer sharing work with computers that are only in a workgroup and not a domain?

They are replacing NTLM, not just killing it off, but it's not a drop-in replacement and so apps that use NTLM will need some remediation.

In particular you'll still be able to do the workgroup thing.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#68

Post by cryptonector »

I'm late to this party so this comment will be buried, but I hope it's useful to someone.

MSFT will be replacing some of the NTLM functionality with something called IAKERB, which is a GSS-API mechanism (aka, an SSP in Windows terminology) that allows the server application to proxy Kerberos messages between the client and the Kerberos key distribution centers (KDCs), and this will replace two things that NTLM provides:

  - support for cases where there is
    no direct line of sight between
    the client and the KDCs
  - support for using username &
    password local to the server by
    having the server have its own
    local KDC
The only NTLM feature not provided by the new thing is the ability to InitializeSecurityContext() without naming the target service. This is why it's not entirely a drop-in replacement, and NTLM-using applications do need remediation for this (and, along the way, to replace uses of the NTLM SSP with the Negotiate SSP). Because the apps always know a name for the target, there is no reason that this remediation should be hard. Therefore you can consider all the NTLM functionality replaced by IAKERB.

EDIT: I don't mind downvotes, but if I'm trying to provide useful technical information and you disagree with it it, it might be useful to say so because a) I might be wrong, b) you might be wrong, c) others might learn something.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#69

Post by josephcsible »

cryptonector wrote: post #67
josephcsible wrote: post #19

How will file and printer sharing work with computers that are only in a workgroup and not a domain?

They are replacing NTLM, not just killing it off, but it's not a drop-in replacement and so apps that use NTLM will need some remediation. In particular you'll still be able to do the workgroup thing.

What is its replacement for file sharing in workgroups, though?

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#70

Post by cryptonector »

josephcsible wrote: post #69
cryptonector wrote: post #67

Earlier quoted context omitted.

They are replacing NTLM, not just killing it off, but it's not a drop-in replacement and so apps that use NTLM will need some remediation. In particular you'll still be able to do the workgroup thing.

What is its replacement for file sharing in workgroups, though?

Every server runs a local KDC backed by the local SAM, so when you authenticate to a server in workgroup mode you'll be using Kerberos over IAKERB to do an AS exchange (think `kinit`) followed by the AP exchange. So you still get standalone username & password authentication.
Post reply on HN