I've been looking at the NTML2 Session Response which is apparently supported transparently by commonly used browsers. NOTE: This is not to be confused with full NTLMv2 authentication. This in-depth and detailed explanation describes the core process.
The upshot: this scheme is known to be subject to offline dictionary attacks as discussed in this presentation from 2004. One of the main issues is that it creates a MD4 hash of two bytes which means you can compute the 65536 possible results for that part of the response for any given challenge and client nonce and rule out (generally) 65535 out of 65536 passwords by doing just the MD4 hash.
What I find really surprising is that Chrome is 'willing' to engage in this scheme (IE: not surprised). Disabling this option on a given server manageable but that doesn't prevent people from setting up simple web pages that will silently negotiate with the browser to send the insecure response. Am I wrong to think this it's irresponsible to make this the default behavior? Shouldn't this be opt-in given the risks and how esoteric this is?
On a side note, if anyone has any reference on what rate of MD4 generation is achievable, please respond. I can find things for MD5 but I believe MD4 is easier.