-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Um, NTLM isn't the only 20 or so year old protocol to take the rap recently, I can think of a low numbered rfc, lets say 1034 and 1035. Hindsight is 20/20, and 20 years ago, who would have thought that a 16 bit number was way too small for DNS transaction id, the same "who would have though" goes for NTLM and the rest. Lets face it, protocol design bugs suck, and to completely replace a widely used protocol ranks pretty high in the PiTA hall of fame...
On Tue, 25 Nov 2008 05:25:57 -0500 Eric Rachner <[EMAIL PROTECTED]> wrote: >Hey, kid - > >If you've got any better ideas about how to fix NTLM, the industry >is ready >& waiting to hear them. > >The fact is, NTLM is an old & busted protocol that happens to be >used * >everywhere*, and there's no way to fix it without breaking >compatibility >with, oh, just the entire installed base. I was happy to see MS08- >068 >because the technique it implements is better than nothing - it >offers a >nice, clever way to reduce the exploitability of the issue without >breaking >anything important. > >Don't bother telling us all how M$ should just bite the >incompatibility >bullet and turn NTLM off - that's been an option for users, >theoretically >speaking, since about the time Windows Kerberos support became >mature, and >practically speaking, nobody seems to be turning NTLM off here in >the real >world. > >- Eric > >On Tue, Nov 25, 2008 at 7:44 AM, Memisyazici, Aras <[EMAIL PROTECTED]> >wrote: > >> <RANT> >> >> <snip:: taken from MSRC Blog: >> http://blogs.technet.com/msrc/archive/2008/11/11/ms08-068-and- >smbrelay.aspx >> > >> >> What we released today with MS08-068 is that security update. It >addresses >> the SMBRelay issue (discovered in 2001) does so in a way that >doesn't have >> the negative impact on applications that we originally believed >addressing >> this issue would have. >> >> </snip> >> >> So... Hmm... I wonder what would happen if the rest of the world >followed >> suit with M$' approach, and took 7 years to "fix" an issue in >order to "not >> cause a significant impact"... >> >> Scenario: >> >> Ppl: Hey Ford, if one brute-forces the keyless entry on the >door, you're >> car explodes... >> >> Ford: well... I'll offer you three choices, two immediately, and >the last >> one 7 yrs later. You can either not use the keyless entry system >(we'll give >> you some shiny duck-tape to cover it) or you can use the >biometric-knub >> system which requires that you have a knub... So those who have >arms & legs >> can't use the system... (btw this will give birth to a whole new >industry >> that will allow ppl to pay money for a product that fakes a knub >for people >> with appendages) But it's biometric & cool this way! Or you can >wait for 7 >> years and we'll release a non-exploding version of the keyless- >entry system. >> >> *************************************** >> >> OK... Maybe I'm going a bit extreme, but WTH?! Am I the only one >who is >> interpreting this, this way? Really? When has releasing a >solution to a >> problem 7 years later ever been acceptable? >> >> Jus' sayin' ... >> >> </RANT> >> >> Aras 'Russ' Memisyazici >> Systems Administrator >> Virginia Tech >> _______________________________________________ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> -----BEGIN PGP SIGNATURE----- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQECAAYFAkktAd8ACgkQi04xwClgpZhz/wP/XksVY9PcYZ9Rs5iDMAkw7qa/2FIw UsdD78zHzH5JuFTl0gTozNBRJwWZfxdp3frDjtKAIUl6qVvhd2Kv/lOzVU70mNm/4VlM tC+YqiYMVuMC0flaUwYOxOwfcxaXE+YBWWxMvM7DgNayVqiAwhrsyPNQLv3dAc6jaXtC rvGdXhI= =8pzj -----END PGP SIGNATURE----- -- Click for amazing quotes from local deck contractors & remodelers. http://tagline.hushmail.com/fc/PnY6qxtz6M04r4PUxw0zUeIGPUNC89x4D6yvwbXxUKMzgFsomHdoM/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/