Comment on Windows RDP lets you log in using revoked passwords. Microsoft is OK with that. - Ars Technica

2xsaiko@discuss.tchncs.de ⁨2⁩ ⁨days⁩ ago

Their stated reasoning here sounds bullshit and I’m sure the actual reason is a technical one, where they’re trying to retrofit the MS accounts login system to a protocol that wasn’t designed for it and for some reason are refusing to extend the RDP protocol to support the new auth mechanism. SMB network shares probably have the same issue I’d assume.

I’m sure AD domains don’t have this problem since it uses Kerberos, otherwise this would have been a problem already decades ago.

Using the password for a public account for local login is a disaster anyway, they should have done it like Apple and kept the local login password separate from the MS account login. I have never used a MS account for local login but it sounds to me like it just leads to people using insecure passwords for publicly reachable accounts because they don’t want to type a long password every time logging into their computer.

source
Sort:hotnewtop