bugtraq - Re: LM hashes in a hot-desking environment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 27 May 2006 12:31:46 +0200
From: Ansgar -59cobalt- Wiechers <bugtraq@...netcobalt.net>
To: bugtraq@...urityfocus.com
Subject: Re: LM hashes in a hot-desking environment


On 2006-05-25 feedb4ck@...k.org wrote:
> Although it is a well known fact that Windows desktops and servers
> still use LM Hashes and cache the last ten userids and passwords
> locally, just in-case an Active Directory, Domain, or NDS tree are not
> available, has anyone thought about the consequences of this issue in
> a hot-desking, or flexible working environment?

That's why you use policies to disable use of LM hashes and caching of
passwords in environments like that.

Regards
Ansgar Wiechers
-- 
"Der Computer ist da, um zu rechnen, nicht um Ausreden wie 'Kann nicht
durch Null teilen' auf den Bildschirm zu schreiben."
--Marco Haschka in de.org.ccc