4 ms·
I mean it is their fault, for a naïve implementation and trusting Windows.
by kamray23 5y ago
I mean it is their fault, for a naïve implementation and trusting Windows.
- monocasa 5y agoIt's the mechanism meant for untrusted links, and it's the prescribed way for instance to open a link in the user's default browser. If Chrome took that link and started sending the user's password hash, that'd clearly be Chrome's fault. Same with, say, an ftp client that listened for ftp paths and would send replayable hashes as the first step. It's clearly SMB's terrible protocol. Yes they removed UNC paths to hack around this... but they shouldn't have to. Nope should they be expected to have known about this particular Windows footgun, IMO.