This article uses NTLM passwords. Can anyone compare this to the actual MSFT recommended Kerberos security protocol? Also, how does one go about getting a lis

This article uses NTLM passwords. Can anyone compare this to the actual MSFT recommended Kerberos security protocol? Also, how does one go about getting a list of NTLM passwords to work against? You steal the domain controller or somehow get access to it? http://en.wikipedia.org/wiki/NTLM http://en.wikipedia.org/wiki/NTLM MSFT does not recommend using NTML which is very old. http://msdn.microsoft.com/en-us/library/cc236715(v=PROT.10).aspx http://msdn.microsoft.com/en-us/library/cc236715(v=PROT.10).... Implementers should be aware that NTLM does not support any recent cryptographic methods, such as AES or SHA-256. It uses cyclic redundancy check (CRC) or message digest algorithms ([RFC1321]) for integrity, and it uses RC4 for encryption. Deriving a key from a password is as specified in [RFC1320] and [FIPS46-2]. Therefore, applications are generally advised not to use NTLM.<68>