Steve Syfuhs
@syfuhs
Noted idiot. Principal something or other. Runs the Windows Authentication team at Microsoft. It's my fault your password doesn't work. Mostly dog pictures. Might actually be two dogs in a trench coat. 🇺🇸 / 🇨🇦
My dog is named Bruce. After Bruce Wayne. Nothing silly about him whatsoever. Not a thing. Nope.
Me: Pfft, stupid sign. I'll do what I want. *attacked by birds* Me: coincidence
What's wrong with that you ask? A myriad of things, least of which is this. The crypto is easily crackable because it's fast. Usually we like fast crypto, however this is the one place we realllllly need it to be slow. Oops. Moore's Law biting us.
It's a challenge response. Client tells the server "yo, I wanna auth". The server ignores the tone and says "halt, papers please". Client says "fineeeee" and does an MD4 hash of the user password, HMACs the server's challenge with the hashed password as a key and sends it back. Server ACKs.
For those wondering about the specifics and don't want to watch me crack bad jokes... NTLM is bad because the crypto is...well, it's shit. MD4! It uses a fricken MD4 hash of your password as a key to sign a challenge response.
Oh hey by the way. They convinced me to go to Build this year. Things are happening. Might maybe be an interesting keynote.
...because I was looking for this jerk. (33.783544, -117.999958) And then said screw it. Lets pan around and see what I remember from growing up in this area 25-37 years ago.
I had searched "Forget me not hill" because I was dicking around on satellite maps and came across this curious structure and wanted to know what it was (33.918327, -117.529658)