3 ms·
Microsoft Active Directory servers store passwords as plain MD4 hashes. http://16s.us/ms_ad_hashes/ http://16s.us/ms_ad_hashes/ These servers are used by gover
by 16s 14y ago
Microsoft Active Directory servers store passwords as plain MD4 hashes. http://16s.us/ms_ad_hashes/ http://16s.us/ms_ad_hashes/
These servers are used by governments and large organizations all over the world.
- 3mpach3r 14y agoI would like to assume that the REALLY big companies like Google, Microsoft, Apple, Amazon, etc. can figure out how to effectively store passwords. While I acknowlege that Active directory is a bit different from a web service, if this can't be realized, god knows what's happening with the other 500 sites we all have accounts on (that invariably use shared passwords: http://xkcd.com/792/ http://xkcd.com/792/ ). I really love it when I get password reset emails with my original password in plain text.
- 16s 14y agoExchange email systems have web interfaces. They typically authenticate with AD.
- dredmorbius 14y agoDiscussing hashes internally with Commander Adams, among the reasons we use unsalted hashes for internal passwords was that Google Mail for Domains (with which we use an SSO tool) doesn't work with salted hashes. Or should I be siccing Krell monsters on the good Commander again?
- yuhong 14y agoYea it dates back to the beginning of NT (which is why it is MD4) and by now this hash is used in so many Windows protocols it is hard to change.