Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That's why we have Kerberos.


No Kerberos won't help in this case. Once you have the keytab you can impersonate the client. Kerberos doesn't solve the "trusted client" issue.


It doesn't help in the Twitter client use case, but it will help in the user/password compromise scenario described in the parent comment.

If I compromise the keytab, I can impersonate the domain member server and presumably the active tickets... but the username/password is on the KDC/DC.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: