Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Live Account Credentials Leaking from Windows 8 and Above

hackaday.com

Post reply on HN
Print view View original

111–120 of 144 posts

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#111

Post by ralphc »

ocdtrekkie wrote: post #109
ralphc wrote: post #99

Earlier quoted context omitted.

I've poked around in there. Think of live tiles as the latest version of desktop gadgets. I installed the weather channel free app, I now see local weather when I hit start.

The MSN Weather app is preinstalled with Windows 10, and has the same basic capabilities. And since you don't need to install it, doesn't require you sign into a Microsoft account. (I actually like setting up this app on enterprise users' start menu, it's a nice extra. And they don't have Microsoft accounts connected.) The built-in weather app and tile is solid enough that I find people downloading a third party one…

I think I saw it on a list of windows 10 apps to get somewhere. Clicking on it gets you a radar map. Really it was half weather, half trying out the windows store experience.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#113

Post by robododo »

Just to clarify the article a bit:

Your password hash is not sent over the wire. What is sent over the wire is the NTLMv2 response message. This, simplified, is: HMAC_MD5(Hash | challenge). If you want the gory details, check out MS-NLMP.

That said, a dictionary-attackable password + attacker with fast GPUs can still brute-forcing the HMAC, then attack the password hash (MD4). It's a bit harder than just banging on a simple hash, though not terrifically difficult.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#114

Post by nacs »

yAnonymous wrote: post #11
cylo wrote: post #6

Earlier quoted context omitted.

To make the password hash harder to crack. There's a big difference in time to crack the hash for "Passw0rd" vs "$)63hjbbdhs23".

>$)63hjbbdhs23 Great, I'll just store this in my password manag... oh, wait.

Just write it on a Postit and affix it to your monitor.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#115

Post by 5350-uiop-1130 »

Nokinside wrote: post #42

As a Linux user I have kept Windows 7 & 8 partitions in my laptop and workstation disks for years because there used to be time where you needed Windows in the work for some programs to work and some documents to open. Windows 10 upgrade push made me to realize that that time passed a long time ago. Last time I booted to Windows for other reason than playing a game was seven years ago. LibreOffice works well with MS…

I don't get the general negativity around Windows. Variety, for me, is a good thing. Every OS has it's strengths, weaknesses and use-cases.

I know the argument is often framed as open vs closed source ecosystems but I think and hope that ultimately having more options and more variety is good and interesting for us.

Windows, does deservedly get a lot of stick for it's past issues (windows rot etc) and present issues. However, I think ultimately what we learn from these scenarios is extremely beneficial for a lot of people.

As a Web Developer I hated IE 6. I still do. But, I have to admit that it taught me a lot. It taught me about the box-model. It taught me how to debug JS before the days of Firefox/Firebug. I know this was not by design or intention and I know this is easier to say in retrospect.

I can imagine a lot of people working in info-sec learnt a lot from the various failings of Windows and other platforms too.

I guess my point is don't be negative for the sake of it. If Windows is bad, I hope it improves. Same goes for all technologies. I'm a Chrome user but I still love to run Opera, Firefox and Edge now and then because I enjoy different experiences and love playing with new apps and features. I also have a Macbook for work and and and Ubuntu partition. I enjoy using them all.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#116

Post by sliverstorm »

daemin wrote: post #17
pjc50 wrote: post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

You can actually have Windows logged in with a local account (normal old school account) and use the store with a different Live account. But yes, I am quite annoyed by them requiring that I use online credentials to log in to a physical computer. I prefer to separate the two authentication mechanisms.

I am quite annoyed by them requiring that I use online credentials to log in to a physical computer

Is that substantially different from every corporate domain login credential system?

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#117

Post by Ntrails »

pjc50 wrote: post #9

And people wonder why some of us haven't upgraded from Windows 7. Win10 tries really hard to make you log into your desktop with your Live Account credentials - you can't use the store without this. Whereas if it were just leaking a local login it would be much less critical.

I've had windows 10 for a long time and didn't know you couldn't use the store with a local only user. Why? I've literally never clicked on the store button (except to delete it along with heaps of other shit in my start menu).

I genuinely cannot imagine the day that I want a thing and go to the windows store to get it. Last night I installed AutoHotKey and Notepad++ for example (both long overdue admittedly) - all through my browser. Simplez.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#119

Post by Relys »

yAnonymous wrote: post #11
cylo wrote: post #6

Earlier quoted context omitted.

To make the password hash harder to crack. There's a big difference in time to crack the hash for "Passw0rd" vs "$)63hjbbdhs23".

>$)63hjbbdhs23 Great, I'll just store this in my password manag... oh, wait.

https://www.yubico.com/

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#120

Post by wazoox »

djaychela wrote: post #79
bsilvereagle wrote: post #53

Earlier quoted context omitted.

> Windows has lost it's grip for good. For your listed use case of gaming & document creation. There are a lot of niche applications that are Windows only. All major CAD platforms, a decent chunk of FEA packages, hardware vendor software, etc. At the professional level, Windows still has quite the grip.

Yeah, it's the only reason I have a Windows laptop (or desktop) - I teach music technology, and that means a DAW which works - in my case Cubase - so unless Steinberg changes their mind on supporting Linux (which seems massively unlikely given the amount of effort needed to get it working properly), I'll have to have a Windows machine for the foreseeable future; everything else I do is done on my Chromebooks (one Chr…

You should try Ardour. It can even use windows VST plugins on Linux.
Post reply on HN