NTLM Authentication

If you configure Internet Information Server (IIS) to do Windows NT challenge/response instead of basic authentication, it sends the header "WWW-Authenticate: NTLM" when asked for a protected URL. Microsoft Internet Explorer (MSIE) and IIS then perform a security handshake that relays an encrypted password to IIS.

For transactions between IIS servers and MSIE browsers, this approach seems clearly superior to basic authentication, because no clear-text password travels on the wire. Note, however, that in all versions of MSIE p rior to the shipping version 4.0, NT LAN Manager (NTLM) authentication has some unpleasant characteristics:

1 As part of the security handshake, MSIE sends your user name, NT domain name, and host name in clear text. That's more than you want random servers on the Internet to know about your LAN.

2 The client encrypts its password (actually, a hash of the password) using a challenge (aka nonce, or one-time pad) sent from the server. The challenge is supposed to be random, but, as Paul Ashton has shown (see http://www.efsl.com/security/ntie ), a rogue server can always send the same challenge, which it can also have used to precompute a large database of possible passwords.

3 The security handshake occurs invisibly to the user. Why? MSIE fi gures that because you've already logged on to Windows once, there's no need to be prompted again for a name and password. You can automatically pass those credentials to an IIS server, just as you automatically pass them to file servers on your LAN. Of course, the Internet is not your LAN. Paul Ashton summarizes the situation nicely: "Wouldn't you like to see a message: www.foobar.com has requested your NT user name and password. Would you like to send it [YES] [NO] [Don't bother me again]? I know I would."

Microsoft's response? Upgrade to the final shipping version of MSIE 4.0. It carves the world into zones and makes automatic log-on behavior the default for the intranet zone (your local network), but not for the Internet zone (everywhere else).