On Sun, 06 Jul 2008 12:19:17 -0700, Darren New wrote:

> Jim Henderson wrote:
>> What is the current max length of a Windows password?
> 
> I'm not sure, and it changes depending what you're doing. Just logging
> in locally? Logging into a domain? Talking over SAMBA? Talking to a
> non-windows-NT SAMBA? It's at least 14 characters, and if you make it
> that long, the 7+7 broken hash in the login doesn't work any more.
> (I.e., at 14+ characters, you can't brute force it nearly as easily as
> at 13 characters, because Windows no longer exhibits the flaw that makes
> it easy to crack.)

Well, unless you need NTLM authentication - then the weakness is still 
there.  But 14 characters is what I recall.

>>> [1] Bonus points to any flames about AD, that you can install windows
>>> on something other than C:, and so on.
>> 
>> Not sure I follow here - unless you're saying that with AD the key
>> isn't stored on the local machine...
> 
> Only that saying "C:" is a generic term, and I'm aware of that fact.

Oh, I see.  And was that a request for flames on AD?  Because I could 
come up with a couple. :-)

Jim

Post a reply to this message