Re: Logon protocols

From: Invisible (orphi69_at_hotmail.com)
Date: 06/18/03 

Date: Wed, 18 Jun 2003 02:23:51 -0700

>> So when a user tries to log in, the client sends their
>> username and a hash of their password to the DC?
>
>Using NT, yes. A hash would be generated by the client
and sent to the *DC.
>If there was a match, then the user was authenticated.
Pretty standard
>system.

Right.

>> Is this suseptable to a replay attack?
>
>In theory, yes (NT only), although you wouldn't really
even need to go to
>the trouble. You could sniff the hash off the wire, run
it through
>L0phtcrack, and then just log in as the user.

Is it really that easy?

Just out of interest, do you happen to know what port(s)
all this happens on? I think I'm gonna go block them at
the firewall before someone deleted our Oracle database or
something...

>Kerberos, on the other hand, uses a significantly more
secure scheme, the
>details of which are available elsewhere, and are too
complex to outline
>here. Suffice it to say that it is a time/ticket-based
system that would be
>quite difficult to replay.

Would I be right in thinking it involves asymmetric
cryptography?

Thanks.

Relevant Pages

  • Re: Custom Authentication with WSE 2.0
    ... Get the Client to hash the password before sending the password over. ... Based on the custom handler in web.config Wse instantiates the custom ... to encrypt the passwords (the username for example), so that way I can come ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Secure Login Form
    ... something to store a username and the SHA1 hash value of the password. ... before passing it to the database for a check via a PHP file. ...
    (Security-Basics)
  • Re: PasswordOption.SendNone
    ... the client sign or encrypt the HASH of the message with ... The Message together with the Ciphertext ... is then sent over to the WS together with the username. ... client) from a database or whatever storage medium you have...(This model ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: PasswordOption.SendNone
    ... the client sign or encrypt the HASH of the message with ... The Message together with the Ciphertext ... is then sent over to the WS together with the username. ... client) from a database or whatever storage medium you have...(This model ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Poplist size
    ... Hash: SHA1 ... username. ... Is there a limit (quantity or memory) on how big the ...
    (comp.databases.oracle.tools)