bugtraq - Re: LM hashes in a hot-desking environment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0605271604400.11413@ncohafmuta.asteroid-b612.org>
Date: Sat, 27 May 2006 16:09:46 -0600 (MDT)
From: The Little Prince <thelittleprince@...eroid-b612.org>
To: bugtraq@...urityfocus.com
Subject: Re: LM hashes in a hot-desking environment



On Sat, 27 May 2006, Ansgar -59cobalt- Wiechers wrote:

> On 2006-05-25 feedb4ck@...k.org wrote:
> > Although it is a well known fact that Windows desktops and servers
> > still use LM Hashes and cache the last ten userids and passwords
> > locally, just in-case an Active Directory, Domain, or NDS tree are not
> > available, has anyone thought about the consequences of this issue in
> > a hot-desking, or flexible working environment?
> 
> That's why you use policies to disable use of LM hashes and caching of
> passwords in environments like that.
> 

Exactly. You don't do caching on computers that won't ever come off the 
network. i.e. don't do it on desktops. If you have that much of a problem 
with AD being unavailable, you better look more closely at your AD 
architecture.
You may do caching on laptops, and then i'd hope you don't have people 
sharing laptops. If you do, well then, that's another story requiring 
careful consideration, but a little off-topic.

--Tony
.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-
Anthony J. Biacco                            Systems/Network Administrator
thelittleprince@...eroid-b612.org             http://www.asteroid-b612.org

        "as I always say, why go Merlot, when you can call a Cab?"
.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-