Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'll readily admit I'm pretty clueless when it comes to cryptography, so there may already be some false assumptions in the question title itself :-)

Still, I "heard" that it is more secure to store the hashes of the username/password combinations than only the hashes of the passwords. (Salting?)

If so, are windows user passwords stored like this? (And if not, are they stored somehow differently that "only" the password hash?)

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

The file containing passwords in Windows clients is called the SAM file. All passwords stored locally in the SAM file (e.g. local accounts) are hashed with a salt.

Active Directory on the other hand will store passwords without a hash, but in a different file on the Domain Controller. Domain account passwords are stored locally by default for users to be able to sign on when they cannot connect to a DC, and these passwords are hashed with a salt as well.

See here: Does Windows really still use unsalted MD4 for password storage?

share|improve this answer
    
I'm still left confused what's with the passwords on my local PC (not part of a Domain). Googling for SAM file doesn't really enlighten me. Sorry for being dense here :-) –  Martin Oct 24 '11 at 14:49
    
@Martin edited... :) –  Steve Oct 24 '11 at 14:56
    
Thanks! Now I'll be so bold to ask clarification on whether the Salt is the user name (or whether this matters at all)? :-) –  Martin Oct 24 '11 at 15:12
    
You know, I don't actually know. I would assume it's a randomly generated value, but don't quote me on it. Does it matter? Hard to sayt: security.stackexchange.com/questions/8015/… –  Steve Oct 24 '11 at 15:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.