Suppose your university has a centralized ldap server used to authenticate all students, teachers and staff for all services provided by the university (email, exams, taxes...) Suppose that in the computer lab it is possible for every authenticated user to issue an ldapsearch and get all the data of all people in the university: students, teachers, technicians... Suppose the data contains also the fields: sambaLMPassword and sambaNTPassword with the encrypted password of each person.
Now suppose you are a little worried (you are a teacher and think that maybe the students could crack the system and stole passwords) so you speak with the technical staff of the university and they say something along the following lines:
- we know this since a long time, but the password hashes are needed by some old service we need to keep;
- anyway the passwords are encrypted and it is illegal to brute force them;
- and our students are not so smart to understand that they can obtain and decrypt them;
- however, please, keep this secret.
Would you be reassured by the answers? What would you do next?