3 ms·

This might be a stupid question, but why doesn't Microsoft just use a better hashing algorithm?

• hnick 6y ago
  Although, in some cases just having the hash is enough: https://en.wikipedia.org/wiki/Pass_the_hash https://en.wikipedia.org/wiki/Pass_the_hash User PC gets owned, attacker elevates to admin, now has access to IT Support hashes cached locally which can be sent to other devices directly to authenticate.
• tialaramex 6y ago
  This is ultimately an interesting question. The immediate answer is that Microsoft built the systems this is discussing last century and at the time this wasn't highlighted. Both the LANMAN and NT schemes are from the era when Microsoft was just getting into stuff like remote authentication that we now take for granted as a baseline. Even though it's probably true this is an unsatisfying answer because the Unix password hash (at least a decade older) is stronger, using 12-bit salt and a deliberately pessimized hash algorithm. A further (and longer lived) excuse for Microsoft is that they strongly favour backwards compatibility which has seen their company be very successful over a long period. Having accepted this poor scheme in the 1990s it was hard to give it up and annoy millions of users. One of the grave mistakes Microsoft made a little later is that they began relying upon these password hashes as secrets themselves, and that's where it starts to get interesting, because that's a sign that key people at Microsoft didn't know that they didn't know what they were doing. That is, not only did Microsoft not have people who were competent to do this properly, they didn't even have people who knew they needed those people.