Re: Hack MSN anyone?

I was curious about the below message, and checked... 

MSN uses CHAP (PPP's challenge-response handshake) for network layer
authetication, and NTLM (Windows NT's challenge-response handshake) for
application-layer authentication. The password is never sent in across
the network. Challenge-responses encrypted with the password are sent.

Lee Fisher

| The names have been changed to protect the innocent...
| I need say no more I'm sure.
|
|| Yes, windows95 dialup networking uses compression to send the
password
|| when connecting. Thanks for using the Microsoft Network
||
||| Problem Description: Microsoft being security conscious and all, I
||| would hope that when I connect to MSN over the Internet, that my MSN
||| client has the decency to ENCRYPT my password when it sends it over
the
||| net,  yes?  This is the first time I couldn't get through to a
dial-up
||| connection and had to access MSN using my ISP.  Having done so, I
find
||| it extrememly convenient, and would like to continue to do so. 
Thanks.

On Thu, 25 Apr 1996, Lee Fisher wrote:

> I was curious about the below message, and checked...
> 
> MSN uses CHAP (PPP's challenge-response handshake) for network layer
> authetication, and NTLM (Windows NT's challenge-response handshake) for
> application-layer authentication. The password is never sent in across
> the network. Challenge-responses encrypted with the password are sent.

Thanks; that's what I thought.

Never believe anything you're told by tech support. It was pretty clear to
me that the poor undereducated sod had the words "compression" and
"encryption" confused. NTLM isn't perfect, but it's difficult enough to be
secure enough for MSN. You're not doing anything IMPORTANT on MSN, are
you? 

Due to Win95's open memory model, there's probably some system call that a
virus/trojan can use to ask politely for the username and password; in
fact, isn't it the same API that has already been demonstrated? But if you
let such a beast on your machine, all bets are off anyway.

-rich