Meeting the InCommon Assurance profile criteria using Active Directory

["Rank, Mark" <>]

Ron:

"This just reinforces my conviction that the world would be a much better place without Windows.  If only IBM had chosen CPM instead of MS-DOS back in the day."

 

I often wonder what would have happened if Ken Olsen would have hired a few more marketing and product strategy folks for DEC instead of all the engineers... ;)

Mark

--------------------------------------------------

Mark Rank
Project Manager - Identity & Access Mgt

UCSF Information Technology Services (ITS)
email:

phn:414-331-1476

--------------------------------------------------

---

From: [] on behalf of Ron Thielen []
Sent: Friday, June 21, 2013 10:13 AM
To:
Subject: [AD-Assurance] Sorry for the NTLMv1/v2 confusion

I apologize for nearly derailing the conversation.  While I still maintain that hash stealing attacks against NTLMv2 are irrelevant to Silver assertion if you can't use the hash to authenticate to a service that compromises the actual password (e.g. as long as Shib isn't using Windows authentication), the piece I confused was that NTLMv1 does actually pass the password.  So, a brute force attack on v1 does get you the actual password, not just a hash collision.

 

This just reinforces my conviction that the world would be a much better place without Windows.  If only IBM had chosen CPM instead of MS-DOS back in the day.  :-)

 

Ron