Summary of HN Discussion Themes
The discussion revolves around Mandiant (a Google subsidiary) releasing a large dataset of pre-computed "rainbow tables" to crack the long-deprecated NTLMv1 authentication protocol. The conversation highlights three main themes: the protocol's antiquated and insecure nature, the debate over Google's motives and corporate behavior, and the practical implications of releasing such tools for security professionals and attackers alike.
1. NTLM is an Insecure, Obsolete Protocol That Should Have Been Retired Decades Ago
Many participants expressed shock and disbelief that a protocol from the 1980s is still in use in 2026, viewing the release as a long-overdue wake-up call rather than a new threat.
- bawolff: "Keep in mind we are talking about a protocol from 1987. How many protocols from 1987 is google currently using?"
- TacticalCoder: "Holy smoke. I honestly thought the 90s called and wanted their Windows exploits back (TFA mentions 1999). I do remember talk about this from many moons ago. But we are in two-thousand-twenty-FUCKING-six. It's unbelievable. Just plain unbelievable."
- reincarnate0x14: "It's been 15 years since this was known broken. If you had children when it was not known broken, they'd be almost old enough to drive in most western nations. At some point the line must be drawn."
- patmorgan23: "Microsoft has deprecated NTLM and is actively ripping it out of windows... Windows 11 is probably the last version that will contain NTLM (and hopefully NTLMv2). Going forward everything will be Kerberos or Oauth based."
2. Google's Actions are Viewed Through a Lens of Corporate Self-Interest and Power
The discussion frequently pivots to the nature of Google as a corporate entity. Opinions are polarized between viewing Google's security initiatives as aligned with their business interests versus seeing them as another exertion of undue influence over the internet.
- bawolff: "Sure. Not being hacked is good for business. Keep in mind that google is primarily a cloud business. That means that they take on a lot more of a risk, as when they are hacked its a them problem vs traditional software where its much more the customer's problem. Security is very much about incentives, and the incentives line up better for google to do the right thing."
- schmuckonwheels: "Google does whatever is convenient and makes them money. Altruism was never part of the equation."
- schmuckonwheels: "It's more about when Google assumed full control of the cloud, the browser, the OS, and everything in between they self-appointed themselves as the unelected standards board of the Internet, and forced everyone else to follow their whims and timelines."
- alfiedotwtf: "Consulting business? I was under the impression (from Google Reader) that if users aren’t in the millions, then they’ll kill the project. How could they also run a high-touch consultancy?!"
3. The Release is a Practical Tool for Security Professionals to Drive Change
A significant portion of the conversation focused on the practical utility of the release. Participants argued that while attackers already had these capabilities, the release provides white-hat security teams with a legitimate, well-sourced tool to demonstrate risk and justify the cost of migrating away from NTLM to management.
- freedomben: "It also empowers IT depts and cybersecurity people to be able to easily build a PoC to show why moving on from the deprecated protocol is important. In many white-hat jobs you can't just grab rainbow tables from a torrent, so a resource like this is helpful."
- sethhochberg: "The key difference would be that Google is providing it for this purpose and presumably didn't do anything underhanded to collect or generate it... That sort of legal and compliance homework is good practice for any business... but is probably critical to remain employed in the sorts of giant enterprises where an internal security engineer needs to convince management to spend money."
- Retr0id: "I suspect Mandiant hears a lot of 'this is impractical to exploit so we don't care' from their clients. Now they have a compelling rebuttal to that."
- bigfatkitten: "What releases like this do is give IT ops people the ammunition they need to convince their leadership to actually spend some money on fixing systemic security problems."