News for hackers. Stuff that matters.

A comment on Windows RDP lets you log-in using revoked passwords. Microsoft is ok with that.

Re:Windows RDP lets you log-in using revoked passwords. Micr... by notnmeyer on Wednesday April 30, 2025 @09:35PM (#43852790)
That is… insane. In what world is this expected or acceptable behavior?
[ Parent | on HN ]
Re:Windows RDP lets you log-in using revoked passwords. Micr... by pixl97 on Wednesday April 30, 2025 @09:53PM (#43852915)
There are 2 hard things in computer science. Naming things, cache invalidation, and off by one errors.

'Some' of this makes sense but not all of it.

For example let's imagine a linux password system that let's you take a system offline and still use it. You have to cache the password locally and if it doesn't connect to the online system where the password has changed then the old password will still work.

With that said you should also design the system to invalidate the cached password from upstream when it gets a notification it changed.

[ Parent | on HN ]