Why is Kerbero more secure than NTLM?

Kerberos is a trusted third party authentication system while NTLM is a challenge response mechanism. There are more advantages of Kerberos (krb5) compared to that of NTLMv2
NTLMv2 is the imporved version of NT-LanMan auth which was used as a default method in the initial version of WinNT servers.
Krb5 Authentication is much secure compared to NTLM. Krb5 provides SSO (Single Sign On), pre-authentiaction. Now krb5 is standard authentication method for many of the server products.
Additionally, this is the standard protocol does not send the password on the wire.

I would read the  - Basic Overview of Kerberos User Authentication Protocol in Windows 2000
http://support.microsoft.com/kb/217098

I'm not sure you can say "more secure", again the "best attacks" for either are nearly the same, bruteforc'ing a captured authentication. The password is the weakest link in any single factor authentication, using Kerbcrack, Cain&Able or other password BF'ers make short work of simple passwords in NTLMv2 or Kerberos. The main difference between the two is that to use Kerberos the machine your on must be part of a trusted domain, and once you've signed on with kerberos with your password, your password is not sent again until the ticket is invalidated (timed out/logged out). With NTLMv2 (or LM or NTLM) your password is sent via the challenge response each time you access a new resource.
-rich

>>> The main difference between the two is that to use Kerberos the machine your on must be part of a trusted domain, and once you've signed on with kerberos with your password, your password is not sent again until the ticket is invalidated (timed out/logged out).

IMHO ... The passwords are not sent on the wire in case of kerberos which makes more secure.. Instead a fleeting session key is generated for each TGT/ST and encrypted with the users key or the services is presented for each time (AS_{REQ,RES}, TGS_{REQ,RES}).
Additionally pre-authentication which make kerberos authentication less vulnerable to brute force password guessing attacks.

Ofcourse there are a couple of limitations for kerberos such as:
Time sync, replay attacks, inter-session chosen plain text attack and more....

Microsoft authentication protocols such as NTLM largely use RC4 for encryption and MD5/HMAC for message digests.On the other hand, you (as a admin) have the option of creating AES256-HMAC-SHA1 keys for kerberos principals.

 

Your correct, the password are not sent in the same way with kerb, however using kerbcrack(you also need kerbsniff from ntsecurity.nu) or cain&able to sniff and then BF, takes around the same time to BF a challenged NTLMv2 payload. Catching the exchange of Kerb tickets is harder on most lans beacuse, even in 2003 and beyond, NTLM and it's variant NTLMv2 are seldom rolled out, and it's easier to see them more often that kerb. Further challenges can be fixed for ntlm so that BF'ing can be made even faster by using a known value that is computed against a rainbowtable making the BF take no time at all for simple passwords (seconds instead of minutes or hours). From a pen-tester point of view, Kerb and NtlmV2 are nearly equal when it comes to being able to BF a users password.
-rich

I meant to say there is far less kerb traffic(typically) than there is ntlm traffic above... so it's easier to begin cracking ntlm as your more likely to sniff it on the wire than kerb.
-rich

I think independent of the traffic, the time taken of the BF may not be the best bet of evaluating the security of a protocol, as it only depends on size of the password. It may only work for week passwords, and would require large computing speed and time for stronger ones. I would be better to consider the limitations/advantages instead.