3 ms·

Dangerously incorrect (also, the two magic #s are 14 for ntlm and 16 for o365; where did you get 15 from?) 1 - if you have ntlm (non-v2) on your network, you'r

Dangerously incorrect (also, the two magic #s are 14 for ntlm and 16 for o365; where did you get 15 from?) 1 - if you have ntlm (non-v2) on your network, you're fucked anyway and this debate is academic. 2 - even if you do, having a password of 15 or more characters will cause your legacy hash to be set to "AAD3B435B51404EEAAD3B435B51404EE" and will protect you against having your hash cracked if it's stolen from the non-v2 service. 3 - the office 365 limits can be worked around with dirsync or federation (source: I've done both)(note: outlook does weird things with leading/trailing spaces) 4 - those apps should be kerberized or similar

Spooky23 11y ago
My bad on the 15 -- I did a very large O365 migration 3 years ago and haven't been in the weeds for a couple of years. I got my head wrapped around Azure MFA app passwords and the samaccountname limits. In any case, the point is as a user, especially on a big network, you have no idea what your actual effective password strength is. Plenty of places do lots of dumb things with AD -- one example that comes to mine was an inter forest trust between two good sized domains where bad DNS implementation and... Misguided security interpretations basically made it impossible to use Kerberos.