{"action":"closed","issue":{"url":"https://api.github.com/repos/jephthai/OpenPasswordFilter/issues/4","repository_url":"https://api.github.com/repos/jephthai/OpenPasswordFilter","labels_url":"https://api.github.com/repos/jephthai/OpenPasswordFilter/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/jephthai/OpenPasswordFilter/issues/4/comments","events_url":"https://api.github.com/repos/jephthai/OpenPasswordFilter/issues/4/events","html_url":"https://github.com/jephthai/OpenPasswordFilter/issues/4","id":195936248,"number":4,"title":"SecureZeroMemory Call","user":{"login":"ljr55555","id":24596267,"avatar_url":"https://avatars.githubusercontent.com/u/24596267?v=3","gravatar_id":"","url":"https://api.github.com/users/ljr55555","html_url":"https://github.com/ljr55555","followers_url":"https://api.github.com/users/ljr55555/followers","following_url":"https://api.github.com/users/ljr55555/following{/other_user}","gists_url":"https://api.github.com/users/ljr55555/gists{/gist_id}","starred_url":"https://api.github.com/users/ljr55555/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ljr55555/subscriptions","organizations_url":"https://api.github.com/users/ljr55555/orgs","repos_url":"https://api.github.com/users/ljr55555/repos","events_url":"https://api.github.com/users/ljr55555/events{/privacy}","received_events_url":"https://api.github.com/users/ljr55555/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-15T22:44:33Z","updated_at":"2016-12-19T14:29:07Z","closed_at":"2016-12-19T14:29:06Z","body":"I used this project as a base for a password filter with different logic, and it worked perfectly in my tests (password change and bind via LDAP to verify). It, however, failed when someone attempted to log into a workstation. In fact, you could log in with a BLANK password. \r\n\r\nAD computes the ntlm one way hash, calls the filters, and then proceeds to compute the hashes used for kerberos and such. The technet article meant that they assume you've made copies of the password somewhere within your code & you need to run SecureZeroMemory on any copies that you've made *but* they need the PUNICODE_STRING that got passed in to be left alone. And, yes, they will handle *that* copy when their processes are done. Otherwise the password works for some authentication methods and is NULL for others. \r\n\r\n\t// MS documentation suggests doing this.  I honestly don't know why LSA\r\n\t// doesn't just do this for you after we return.  But, I'll do what the\r\n\t// docs say...\r\n\t// LJR - 2016-12-15 - Per MS, they actually mean to wipe any COPIES you make \r\n\t//\tSecureZeroMemory(Password->Buffer, Password->Length);\r\n"}}
{"actor":{"display_login":"jephthai"}}