News for hackers. Stuff that matters.

A comment on LeakyX, a vulnerability that Apple and Microsoft have known about for years.

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by mavhc on Saturday September 23, 2017 @03:50PM (#15321377)
Why is it sending a password at all?, surely it should be at least a hash of the password
[ Parent | on HN ]
Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by raverbashing on Saturday September 23, 2017 @03:54PM (#15321394)
Do not send hashes. Do send challenge/responses. Hashes can be replayed.

(Or send passwords over TLS)

[ Parent | on HN ]
Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by mavhc on Sunday September 24, 2017 @03:03AM (#15323656)
Sure, my question is more is there a history to this protocol? Is it from the 80s or something?
[ Parent | on HN ]
Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by lawnchair_larry on Sunday September 24, 2017 @06:00AM (#15324123)
If that would work, it would mean the hash is actually the password.
[ Parent | on HN ]
Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by jlgaddis on Saturday September 23, 2017 @05:29PM (#15321847)
No, it surely shouldn't.
[ Parent | on HN ]