

0·
18 days agoWhich suggests to me that MS stores plaintext passwords. Because a hash function doesn’t care about the length of what it’s hashing, the output will always be the same length, so they could verify a 300 character password with the same storage space as a 3 character password.
Until they remove checking that reg key from all versions other than maybe enterprise. If they decide that running windows requires an MS online account, they can keep bumping up the difficulty of running it without whenever they want.