News for hackers. Stuff that matters.

A comment on Microsoft Mishandling Example.com. Parent comment

Re:Microsoft Mishandling Example.com by lazide on Friday January 23, 2026 @10:35AM (#46733731)
Not necessarily, the server can say it only supports basic auth and….
[ Parent | on HN ]
Re:Microsoft Mishandling Example.com by gruez on Friday January 23, 2026 @12:18PM (#46735029)
I don't think there's any evidence that windows sends cleartext passwords. The whole reason why NTLM is a thing is to avoid sending cleartext passwords.
[ Parent | on HN ]
Re:Microsoft Mishandling Example.com by lazide on Friday January 23, 2026 @12:37PM (#46735275)
Outlook appears to be
[ Parent | on HN ]
Re:Microsoft Mishandling Example.com by p_ing on Friday January 23, 2026 @12:42PM (#46735331)
The 'https://' disagrees with your 'sending clear text passwords' statement.
[ Parent | on HN ]
Re:Microsoft Mishandling Example.com by lazide on Friday January 23, 2026 @04:03PM (#46737889)
It’s clear text to the receiving server, which is what we’re talking about, not one way hashed.
[ Parent | on HN ]