4 ms·
I always considere NTLM and Kerberos to be very similar, so I am surprised to hear that NTLM is broken. Kerberos and HTTP/2 work just fine together. What in p
by georgyo 5y ago
I always considere NTLM and Kerberos to be very similar, so I am surprised to hear that NTLM is broken.
Kerberos and HTTP/2 work just fine together.
What in particular is broken with NTLM?
- edoceo 5y agoNTLM
- carey 5y agoAt least when it was released, IIS 10 supported HTTP/2, but did not support Kerberos, Negotiate or NTLM authentication over HTTP/2. https://docs.microsoft.com/en-us/iis/get-started/whats-new-in-iis-10/http2-on-iis https://docs.microsoft.com/en-us/iis/get-started/whats-new-i... I’m not sure that it’s a problem with HTTP/2 that Microsoft found no reason to implement Windows authentication for it.
- jiggawatts 5y agoThe HTTP/2 protocol specifically makes this kind of authentication difficult. It's not just IIS, in general it doesn't quite work right.
- marcosdumay 5y agoExtending the sibling comment a bit, if you run it exclusively on HTTPS, with Firefox or some other browser that understands it shouldn't share your password with any site that asks, it's just a bug-prone, slow authentication mechanism. But MS has also the "Negotiate" protocol they made to replace NTLM on IE (because even the IE team considered it irremediably broken). That one is a variant of Kerberos, and a lot of people say just NTLM when they mean "Negotiate with a possible downgrade to NTLM".