Which is more secure NTLM or Kerberos?

Is NTLM over https?

We're using NTLM over SSL (HTTPS) for our web server and authenticating against Active Directory. I'm wondering if the only advantage of SSL/HTTPS is to prevent someone with "snooping" software from seeing the username and password in plain text during a handshake. Does SSL/HTTPS allow someone to intercept login data like plain text? Our server has no other web services so the only way to get authenticated would be to sniff the login information. My company's IT security policy says to always use SSL/HTTPS for all web connections. Your IT security policy says to always use SSL/HTTPS for all web connections. No, it says "when appropriate", ie when the risks are not sufficiently mitigated with existing technologies. For example, on a desktop computer, the potential threat model is mostly limited to people that you don't trust, which may include the physical owner of the computer and your colleagues. However, it also covers malware that can eavesdrop over a network cable, which isn't quite a viable threat on an internet-facing server.

There is a risk from passive eavesdropping that's largely independent of the SSL or TLS protocol used: you may think that you are communicating with a particular computer organization, but others may be eavesdropping and learning what you're doing, possibly without your consent or knowledge. If you really don't trust those others, this is a problem regardless of the authentication mechanism used. The best defense is don't trust those others.

What is the weakness of NTLM?

Microsoft published a whitepaper discussing their password and session.

authentication protocol called NTLM. It is a Microsoft proprietary protocol.

NTLM is similar to SMB which is a standard created by Microsoft but it. Depends on SMB. For some reason NTLM has gotten much less attention than SMB.

NTLM authentication is typically used for server-to-server authentication and. For remote sessions (ie when a user logs onto another computer from a terminal. On his current computer). Most Windows servers use NTLM. However, NTLM has the
Same vulnerabilities as the SMB protocol that was made public with the original. Windows 95 release. How can we exploit the weaknesses of NTLM? The weakness of NTLM comes when an attacker has already exploited a Windows. Machine and obtained a session. This attacker can take control of the stolen session and use the stolen credentials to log onto any other Windows server. A vulnerability in Windows that does this is known as the "Double Hop". Double-hop allows an attacker to view, access, or modify files or execute. Command using stolen credentials (passwords and session) that were initially. Used by a logged on user. The Double-Hop mechanism was originally discovered by Andrew Szteinen (Szstein. 2002). However, he published very detailed research (Szteinen 2004). He
Describes how an attacker can use Double-Hop to steal a file or execute. Commands. He also describes how to detect Double-Hop by performing a man-in-the-middle attack. He claims that he did all this work because NTLM is such a widely used protocol. However, he does not demonstrate any code.

Let's now take a look at what he describes in his paper. In fact, we'll do more. In Section 4 he describes a Double-Hop attack, Section 5 describes how he detected Double-Hop, Section 6 describes the man-in-the-middle technique, and. Section 7 describes his technique for executing commands using Double-Hop. Let's take a look at this carefully. If an attacker has gained permission to view certain files, the attacker might. Want to read all the contents of those files using the stolen session.

How insecure is NTLM?

NTLM has been out there for a while, and as we all know NTLM has a number of well-known problems.

NTLM is insecure, in my opinion. It's not a good way to transfer authentication between machines. However, it's been around so long that it's hard to find anything useful to say about it that hasn't already been said. So I'll focus on some of the more interesting things about NTLM that I've seen.

NTLM vs. LM When we look at the history of network protocols, we see a lot of protocols that have been replaced. For example, FTP, POP3, and SMTP are all in their third versions. If you ask someone why, they can probably tell you, but chances are they won't know why. You can find the history of all these protocols on wikipedia.

So, as we look at NTLM, we're probably thinking, "what were they thinking?" There are a couple reasons NTLM was used. First, it was pretty easy to implement. Second, it had a name that sounded familiar. Third, it fit into the Microsoft ecosystem.

We can think of the first reason as, "we did what we had to do." We implemented something, and if it worked, then we kept it. That's probably how we ended up with so many different implementations of NTLM.

There's a couple of problems here. First, we don't know if the implementation of NTLM that we're using is actually using the standard NTLM. Maybe, when you check out the RFCs, you can see that this isn't correct. However, we're probably not going to get anywhere if we try to read the RFCs. And we're not going to be able to get answers about NTLM from our network administrator.

So, I don't know that it's a good idea to try to use NTLM if you can help it. But, if you can't help it, you're still better off implementing something else.

The second reason is harder to understand. We have to keep in mind that the entire history of network protocols is filled with protocols that look good on paper, but just aren't that practical. I'm not saying NTLM is like that. But, it's not completely unique.

Which is more secure NTLM or Kerberos?

We are trying to come up with a way to make our intranet accessible securely to employees who are out office or travelling on business. We would like to ensure that when people access the intranet their identity is verified by Active Directory and if they try to access it from outside the building then we want to restrict their access.

We have implemented this by setting the user's computer/user logon as 'Domain User'. The issue we are facing is when a user uses a Kerberos client - they can set their name and password directly without the need for further authentication such as entering their username and domain name in a web page. They can click a button and they can login without any authentication process.

This is fine when the only thing we care about is authentication. However what happens if we implement a web application requiring an application pool and password. If we set up the pool with the application requiring password as well as account lockout and enable anonymous access to the application which forces users to be anonymous why not just grant access using NTLM. I believe the NTLM protocol does not perform well when used in a web server environment.

Is anyone able to confirm the advantages/disadvantages of Kerberos? I have been looking into it and there seems to be many different versions. Does it make sense to have it set up for every user in a network for internal or does it only really work when connecting to a domain? Can anyone confirm the benefits/deterrents of each protocol and if anyone has come across issues with the protocols they have used in a web server environment please let us know! I will also add that we have just implemented our first version of the authentication mechanism (the first in our whole network). It now authenticates via Kerberos but to give our people the ability to not have their computer log on and to still be able to access the information stored in the intranet we don't want them to set their own password. They can access the information without the need to login if they choose to. The issue comes in with allowing them to click buttons and access different pages. We believe that if the user provides their password it validates that they are not accessing an untrusted resource however there is no protection once they click a button.