4 ms·
Reasonable! Anyone who cares about AD security has been AES-only for at least a year now, and most likely much longer, and it's not like these mitigations are e
by ZeroConcerns 10mo ago
Reasonable! Anyone who cares about AD security has been AES-only for at least a year now, and most likely much longer, and it's not like these mitigations are especially hard, unless you're still running some seriously obsolete software.
- deleted 10mo ago[deleted]
- JackSlateur 10mo agoAnyone who cares about AD security has left AD for a long time, no ?
- stefanfisk 10mo agoWhat’s the alternative?
- qubex 10mo agoNetInfo. I’ll show myself out.
- cryptonector 10mo agoWow, NetInfo. What a blast from the past. To be clear NetInfo is not an alternative. It's just not generic enough and not really a good fit for Windows. NetInfo is too much a Unix solution, so there's no cross-realm/domain "forest" functionality, no support for SIDs, etc.
- chuckadams 10mo agoNo takers for NIS?
- polski-g 10mo agoFreeIPA
- JackSlateur 10mo agoWhat is your need ? DNS ? Auth ? File sharing ? Print sharing ? GPO ? Remote control ? SSO ? Authentication or authorization ?
- stefanfisk 10mo agoYes.
- brendoelfrendo 10mo agoAD is perfectly fine. It's actually really good at what it is: a highly-available Kerberos implementation with an integrated directory server. It's not as dominant as it used to be because there are better ways to handle identity for web applications and zero-trust environments, but I don't think that diminishes what AD was good at.
- JackSlateur 10mo agoAD has built-in mecanisms where a random person can execute code on the AD themselves You just have to not make a mistake (easy, just be perfect!) Most people are not perfect; Hence, most people have security issue with AD (see the never ending tail of cryptolocked companies)
- brendoelfrendo 10mo ago> AD has built-in mecanisms where a random person can execute code on the AD themselves Could you provide an example? I'm sure I know what you're talking about, but the way you put it I'm having a hard time figuring out what you mean. > Most people are not perfect; Hence, most people have security issue with AD (see the never ending tail of cryptolocked companies) Yeah, but, how many of those ransomware attacks exploit misconfigured AD environments rather than something more banal like harvesting credentials accidentally checked into Git, or spear phishing for a target? Identity, in general, is hard.
- JackSlateur 10mo agoAD allows connections between two computers that are registered against the active directory, including a random laptop and the AD themselves This is a fundamental difference versus something like oauth: in the former, everything is done to allow RCE on the AD: the code exist; in the later, everything is done to prevent RCE on the issuer; Identity is hard ? Identity is a lot simpler once you assume that: - people make mistakes - code is buggy - infrastructure has issue This is why using things like oauth instead of AD's authentication mecanism is good: because it is secured by default and you must try really hard to allow a wide range of attack
- carlos256 10mo agoNope. AES is not trivial to implement securely, so most implementations simply rely on hardware support. ChaCha20 and XChaCha20 are more secure ciphers.