Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft plans to kill off NTLM authentication in Windows 11

bleepingcomputer.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#71

Post by cryptonector »

acdha wrote: post #33
sebstefan wrote: post #24

So for the uninitiated, what was the issue with NTLM that makes everyone happy they're switching to kerberos?

It’s an old, old protocol full of 90s crypto mistakes - passwords could be brute-forced in hours over a decade ago, it still uses things like MD-5, etc. and there are attacks which cannot be solved within that protocol such as “pass the hash” where you can obtain a hash from a compromised system and use it to authenticate elsewhere even though you don’t have the original password. There’s a long history here: https:/…

> It’s an old, old protocol full of 90s crypto mistakes ...

To be fair the same can be said for Kerberos. It's just that Kerberos has kept up with the times more.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#72

Post by cryptonector »

wannacboatmovie wrote: post #10
gmiller123456 wrote: post #2

Is this going to break things like SAMBA?

No. NTLM is an ancient protocol that dates back to Windows NT 3.1 in 1993. That's thirty years ago. Microsoft has been actively telling customers to "please stop using this" for over 10 years. Enough time has passed. NTLM is the Telnet of file sharing. There was a time and place for it and that time has passed.

Kerberos and PKI go back just as far (further). The thing is that NTLM has never been fixed up to keep up with the state of cryptography.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#73

Post by cryptonector »

folmar wrote: post #17
garganzol wrote: post #14

What is the replacement for single sign-on? NTLM was kind of useful because some web browsers supported pass-through NTLM authentication, making website login process a breathe.

Normal Kerberos. For SSO NTLM was a fallback with no SSO power only.

For the line of sight issues that Kerberos doesn't normally deal with MSFT is adding an implementation of IAKERB, which is a Kerberos-related protocol by which an application server can proxy messages between the client and the Kerberos KDCs on behalf of the client.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#75

Post by patmorgan23 »

WorldMaker wrote: post #61
jeroenhd wrote: post #54

Earlier quoted context omitted.

Windows 8's implementation of UWP was shit for most use cases, though. Desktop users and full screen touch interfaces just don't mix.

I greatly disagree, personally. I don't think enough desktop users gave it a chance. It certainly didn't help that good differentiating features like the better printer stack were just about murdered in their crib. I still think there was a lot of missed opportunity in Windows 8's implementation of UWP and still wonder what might have happened had it been given more time to iterate and more time to showcase its good…

I disagree there are many UI patterns that make an exquisite touch interface and a horrible KB&M interface (and vice versa).

There are certainly parts of windows desktop apps with absurdly small click targets (have you tried to resize a window recently?) That doesn't mean desktop users are in favor of those.

Desktop users generally favor much more information dense interfaces that you can't achieve in a touch interface because the touch targets would be too small.

Can you design an interface that's great for both? Sure, but it's really difficult.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#76

Post by woleium »

jeroenhd wrote: post #47
acdha wrote: post #36

Earlier quoted context omitted.

What would be nice would be if they could allow it only for RFC 1918 addresses with a IP TTL of one – allow the local doughnut shop to keep their old printer a bit longer with a warning but force slacker corp not to keeping procrastinating.

If this does happen, I wouldn't be surprised if someone would start selling dirt cheap "printer upgrade boxes" in the form of small Linux computers with two ethernet ports (or maybe a USB port and an ethernet port, and a WiFi access point especially for the printer) that just run Samba. If the printer is directly attached to the box, they wouldn't even introduce severe security vulnerabilities. Hell, this could be so…

Like this? https://www.aliexpress.com/item/1005002604130322.html

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#77

Post by smegsicle »

drdaeman wrote: post #65
stevehawk wrote: post #39

Earlier quoted context omitted.

Brother recently adopted the same anticonsumer tactics as everyone else

Can you tell more, please? I missed those news.

Tell HN: Brother printers now locking out non-OEM paraphernalia | Hacker News https://news.ycombinator.com/item?id=31860131

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#78

Post by canucker2016 »

cryptonector wrote: post #71
acdha wrote: post #33

Earlier quoted context omitted.

It’s an old, old protocol full of 90s crypto mistakes - passwords could be brute-forced in hours over a decade ago, it still uses things like MD-5, etc. and there are attacks which cannot be solved within that protocol such as “pass the hash” where you can obtain a hash from a compromised system and use it to authenticate elsewhere even though you don’t have the original password. There’s a long history here: https:/…

> It’s an old, old protocol full of 90s crypto mistakes ... To be fair the same can be said for Kerberos. It's just that Kerberos has kept up with the times more.

the weak hashes part is by design - US government design. Exporting software with strong crypto wasn't possible before the late 1990s. see https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#79

Post by smileybarry »

projektfu wrote: post #56
smileybarry wrote: post #11

Earlier quoted context omitted.

It's in the article: (and the whole reason for finally killing off NTLM) > However, Microsoft is now working on two new Kerberos features: IAKerb (Initial and Pass Through Authentication Using Kerberos) and Local KDC (Local Key Distribution Center). > "The local KDC for Kerberos is built on top of the local machine's Security Account Manager so remote authentication of local user accounts can be done using Kerberos,"…

Thanks, I skimmed. I wonder if there are other ad-hoc Kerberos systems like this.

AFAIK there aren't, and that's the reason for that huge chasm between proper Kerberos and NTLM. I think the old Windows 7-era Home Group was somewhat of a mashup between the two with account syncing, but might've been on top of NTLM anyway.

Re: Microsoft plans to kill off NTLM authentication in Windows 11

#80

Post by jeroenhd »

WorldMaker wrote: post #61
jeroenhd wrote: post #54

Earlier quoted context omitted.

Windows 8's implementation of UWP was shit for most use cases, though. Desktop users and full screen touch interfaces just don't mix.

I greatly disagree, personally. I don't think enough desktop users gave it a chance. It certainly didn't help that good differentiating features like the better printer stack were just about murdered in their crib. I still think there was a lot of missed opportunity in Windows 8's implementation of UWP and still wonder what might have happened had it been given more time to iterate and more time to showcase its good…

I used Windows RT on a tablet and it was great. Easily beat iOS and Android at the time, and I still don't get why professionals went for iPads for so long when there were great Windows tablets that did so much more so much more easily.

I used Windows 8 on a laptop and it sucked. Windows 8.1 made the OS usable but it took until Windows 10 until I stopped being annoyed at the random mix between Windows and Windows Mobile UI controls. I still dislike how obviously touch-targeted the Windows applications I'll only ever interact with using a mouse are.

UWP itself was a better model in many ways, but the way they implemented them as a screen filling thing that took away your task bar was a mistake. The design language, which seems to be "make everything flat, make buttons difficult to recognise rectangles, add whitespace wherever you can", is something I'll probably never get over. I use a 1080p screen at 1x scaling, maybe I'm supposed to buy a 4k screen to make UWP feel less bloated?

I think the Windows 7 had perfectly fine mouse targets. I think the design matters too: when I was looking at a fake Windows 7 theme, I saw a picture of the X button independent of the title bar, and it felt weirdly large. Only when I dragged it up to the top right did I notice that the button was much larger than I remembered it being.

The touch targets could've been bigger (the OS was still optimised for stylus based touch screens) but Windows 10's tablet mode shows how that could've been resolved. I'm not suggesting we go back to the tiny buttons featured in Windows 2000, but I'd like to trade some modern whitespace back in for information density.

Post reply on HN