Talk:NTLM

message: The statement "NTLM remains vulnerable to the pass the hash attack, which is a variant on the reflection attack which was addressed by Microsoft security update MS08-068." is complete nonsense. Pass-the-hash refers to using the raw password hashes in memory of a machine to establish new connections. That has absolutely nothing to do with a reflection attack which attacks a client trying to connect to a rogue server by using client's own hashes to connect back to the client over a new connection. The whole vulnerabilities / weakness section is also a little dubious for a number of reasons. One is that references to "cracking" do not explain that an attacker must first break into a machine and steal said hashes. Without that explaination, the reader might get the impression that the non-raw hashes factored with client challenges are being cracked. That is not the case. Similarly, a pass-the-hash attack also must first break into a machine to steal the raw password hashes. There is no protection against such an attack. All auth protocols are vulnerable to such an attack. Kerberos tickets can be used in exactly the same way. And to get password hashes that are actually useful, an attacker would have to break into a domain controller with system privs. That whole section is disingenuous at the least.  — Preceding unsigned comment added by Miallen (talk • contribs) 21:07, 16 July 2019 (UTC)
thread_title: Wrong

message: I'm happy this was broken out from IWA. Thanks. Ozga 02:21, 27 September 2006 (UTC)
thread_title: Thanks

message: Can someone define what NTLM stands for?  Is it an acronym?  "NT" Lan Manager?
I think so. But see http://support.microsoft.com/?kbid=239869, where Microsoft calls it Windows NT challenge/response. Ozga 13:23, 5 October 2006 (UTC)
thread_title: Etymology

message: : <Snipped event log entry>
: Jeffrey Walton
: Noloader (talk) 19:27, 15 August 2010 (UTC)
thread_title: Log

message: The two sentences, "Both MS-CHAP v1 and v2 have been cryptanalyzed.  However, they continue to be in widespread use," would seem to imply that being crytanalyzed is somehow a bad thing.  In this case, I believe what was meant was something more along the lines of, "Cryptanalysis of MS-CHAP v1 and v2 have shown the algorithm is not cryptographically secure, but they nevertheless continue to see widespread use."  Any objections to that change?  Jouster  (whisper) 20:56, 7 June 2007 (UTC)
thread_title:  Poor Word Choice? 

message: The section on NTLMv2 contradicts itself, leaving me unclear on how it really works.  First it says "NTLM2 sends two 16-byte responses to an 8-byte server challenge."  Later, it refers to these two responses as "the shorter response" and a variable-length "second response".  That whole section is confusing, and inconsistencies like this certainly don't help.  Could someone who is certain of how NTLMv2 actually works please revise that section?
--Jeremy Reeder, CJS, CPS (talk) 21:25, 6 August 2009 (UTC)
thread_title:  Contradictory description of NTLMv2 

message: Removed from the article (was the second sentence of the article). I understand the motivation (and the need for a citation), but its not appropriate in the context/flow.
<quote>MS-CHAP is similar and is used for authentication with Microsoft remote access protocols.</quote>
Jeff Noloader (talk) 19:27, 14 August 2010 (UTC)
thread_title:  MSCHAP statement (2nd sentece) 

message: While the *official* documentation is probably of great value to a programmer, it is not really encyclopedic. At best, it might be appropriate for See Also or External Links (and its already in external links). Its also link heavy.
<quote>Microsoft has fully documented the protocol since 2007. 
All Windows Communication Protocols (NTLM being one of them) are documented here:
http://msdn.microsoft.com/en-us/library/cc216513(PROT.10).aspx
The specifications relating to NTLM are:
MS-NLMP:  Main document describing NTLM v1, NTLM v2. etc.
http://msdn.microsoft.com/en-us/library/cc236621(PROT.10).aspx
MS-NTHT: NTLM over HTTP protocol
http://msdn.microsoft.com/en-us/library/cc237488(PROT.10).aspx
MS-NNTP: Specifies the use of NTLM authentication by NNTP (Network News Transfer Protocol)
http://msdn.microsoft.com/en-us/library/cc236774(PROT.10).aspx
MS-POP3: NTLM for use with POP3
http://msdn.microsoft.com/en-us/library/cc239183(PROT.10).aspx
MS-SMTP: NTLM for use with SMTP
http://msdn.microsoft.com/en-us/library/cc246807(PROT.10).aspx
</quote>
Jeff Noloader (talk) 20:04, 14 August 2010 (UTC)
thread_title:  Official Documentation Section Text (Deleted from main article) 

message: Awkward, fishy: NTLM and MS-CHAP  (to paraphrase) are cryptographically identical or cryptographically equivalnet. The paragraph then makes claims about MS-CHAP security (in a *NTLM* article). Is the reader supposed to make the leap, and apply the findings to NTLM?
<quote>Both MS-CHAP v1 and v2 have been analyzed; Bruce Schneier, Peiter "Mudge" Zatko and David Wagner, among other researchers, found weaknesses in both protocols. Still both protocols remain in widespread use.</quote>
Jeff Noloader (talk) 20:49, 14 August 2010 (UTC)
thread_title:  MS-CHAP Cryptanalysis Text (Deleted from main article)

message: The crap below was gutted from The Protocol. The first sentence discusses the SAMBA team's RE efforts. The second sentence starts with a statement about MS-CHAP, makes an unsubstantiated MS-CHAP <-> NTLM equivalency claim, and refers to RFC's that are part of Microsoft PPP extensions.
Freetards (you know who I am talking to): tighten your shit up. This isn't a free software project where others are going to fix your bugs.
Jeffrey Walton
Noloader (talk) 18:21, 15 August 2010 (UTC)
thread_title:  Protocol Section Paragraph (Deleted from Main Article) 

message: WTF???? Where do these terms come from? The crap below was gutted from The Protocol. Freetards (you know who I am talking to): tighten your shit up. This isn't a free software project where others are going to fix your bugs.
Since the freetards could not get the message names right, I have no faith in their ability to properly describe the protocol (worst: all they have to do is reference the specification, and the link is provided in the article).
Looking at Microsoft's specification, the message names are NEGOTIATE_MESSAGE, CHALLENGE_MESSAGE, and AUTHENTICATE_MESSAGE. See NTLM Messages at http://msdn.microsoft.com/en-us/library/cc236640%28v=PROT.10%29.aspx.
Jeffrey Walton
Noloader (talk) 18:18, 15 August 2010 (UTC)
thread_title:  The Protocol (Type 1, Type 2, and Type 3) 

message: This looks like more freetard babble. (1) there are too many vague and uncited statements (2) What is the need for a statement such as, "Many implementations are by Microsoft". (3) In an article discussing a Microsoft authentication protocol, why is a freetard going off on a tangent claiming Samba, Cyrus SASL, Squid, etc are using reverse engineered implementations because they have not consulted Microsoft's published documentation. [sic] (4) Does the third statement even hold in 2010?
Spurious, superfluous, and now removed.
Jeffrey Walton Noloader (talk) 19:05, 15 August 2010 (UTC)
thread_title:  Implementation Text (Deleted from article) 

message: Here it is, in all its glory. It appears to be programmer notes that were dropped in the wrong section.
Jeffrey Walton
Noloader (talk) 20:22, 15 August 2010 (UTC)
thread_title:  NTLM and Kerberos (Deleted Last Paragraph) 

message: It should be said in the article that Opera is the only major Web browser that does not support NTLM authentication. For security reasons, I suppose.  —Preceding unsigned comment added by 85.139.250.34 (talk) 11:02, 9 March 2011 (UTC)
replies: text: What you say has nothing to do with the article, calling it a major browser so it must be cited because of security reasons, if browser compatibility should be added it should have a list of all browsers that support it or not... Look, even Microsoft says the suite isn't secure, if it continues widely implemented no one really cares about this stuff. --Rafaelluik (talk) 18:07, 9 August 2011 (UTC)
thread_title:  Opera 

message: Hello fellow Wikipedians,
I have just modified 4 external links on NT LAN Manager. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added  tag to http://blogs.iss.net/archive/NTLMReflection.html
*Added archive https://web.archive.org/web/20100601113646/http://palisade.plynt.com/issues/2006Feb/rainbow-tables/ to http://palisade.plynt.com/issues/2006Feb/rainbow-tables/
*Added archive https://web.archive.org/web/20141006095627/http://www.aorato.com/blog/active-directory-vulnerability-disclosure-weak-encryption-enables-attacker-change-victims-password-without-logged/ to http://www.aorato.com/blog/active-directory-vulnerability-disclosure-weak-encryption-enables-attacker-change-victims-password-without-logged/
*Added archive https://web.archive.org/web/20070213065618/http://www.midgard-project.org/documentation/ntlm-single-sign-on/ to http://www.midgard-project.org/documentation/ntlm-single-sign-on/
*Added archive https://web.archive.org/web/20120220083823/https://www.objectif-securite.ch/en/products.php to http://www.objectif-securite.ch/en/products.php
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 01:35, 11 February 2018 (UTC)
thread_title:  External links modified (February 2018) 

message: "Whether these protocols are used or can be used on a system which is governed by Group Policy settings, for which different versions of Windows have different default settings." Whether these protocols are used what? Where's the predicate of this sentence? I honestly do not know. Is it just removing the word "which" that is called for? I sincerely don't know how to fix. IAmNitpicking (talk) 11:48, 7 February 2023 (UTC)
thread_title:  Confusing sentence - no verb