Hacker News Reader

I would be very surprised if this sort of problem is not quite widespread among companies with giant userbases.

We'll see more of these, and bigger ones.

Microsoft Active Directory servers store passwords as plain MD4 hashes. http://16s.us/ms_ad_hashes/

These servers are used by governments and large organizations all over the world.

I would like to assume that the REALLY big companies like Google, Microsoft, Apple, Amazon, etc. can figure out how to effectively store passwords. While I acknowlege that Active directory is a bit different from a web service, if this can't be realized, god knows what's happening with the other 500 sites we all have accounts on (that invariably use shared passwords: http://xkcd.com/792/ ). I really love it when I get password reset emails with my original password in plain text.

Exchange email systems have web interfaces. They typically authenticate with AD.

Discussing hashes internally with Commander Adams, among the reasons we use unsalted hashes for internal passwords was that Google Mail for Domains (with which we use an SSO tool) doesn't work with salted hashes.

Or should I be siccing Krell monsters on the good Commander again?

Yea it dates back to the beginning of NT (which is why it is MD4) and by now this hash is used in so many Windows protocols it is hard to change.

Reply on news.ycombinator.com