Sentence 1:On systems or services using NTLM authentication , users ' passwords are never sent in cleartext over the wire . Sentence 2:Instead , they are provided to the requesting system , like a domain controller , as a hash in a response to a challenge - response authentication scheme .