Disabling Internet Explorer "Save my password" checkbox for http authentication

From: Anthony DiPasquale (agdrcc_at_ritvax.isc.rit.edu)
Date: 09/19/03

  • Next message: Milind Nanal: "Vulnerability scanner for SQL injection, HTML injection- free or commercial ?" 
    Date: Fri, 19 Sep 2003 14:38:27 -0400
To: focus-ms@securityfocus.com

    Greetings,

    I maintain several "public" computers that are configured with group
    policy to allow a user to log on with a generic account and the Windows
    shell is replaced by Internet Explorer running in kiosk mode, so they
    basically get a full screen web browser pointed at a particular
    website. (Windows XP Pro running IE6 latest with all patches on a Win2k
    AD environment). This site requires http authentication, so an http
    authentication window pops up stating the realm and asking for
    username/password, and has a checkbox below to save this username and
    password combination. Unfortunately it seems some of our users lack
    the common sense to realize they are using a public terminal that
    always goes to the same website where sensitive information is kept and
    check this box off. The next person to come along and log in to the
    machine is then prompted for the http authentication username/password
    combination and are greeted with some other user's information
    conveniently filled out for them. Is there a way to disable this
    checkbox, or perhaps clear the stored information some how at logout?
    It seems that turning off AutoComplete including the save passwords
    option does not affect the http authentication dialog, and I've also
    tried to disable userdata persistence and set user authentication to
    "prompt for username and password" in the IE security options, but
    neither of these seem to help me.

    Any suggestions? Any idea where this information is stored on the
    system so that it can at least be cleared at logout? It is common
    practice for users to log off the machine after using the kiosk mode
    because the website they visit actually enables an account for them to
    re-logon to the system and use it as a regular workstation, so this
    would be a viable option.

    Thanks in advance!

    -Anthony

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Milind Nanal: "Vulnerability scanner for SQL injection, HTML injection- free or commercial ?"

    Relevant Pages

    • Re: ftp problem
      ... takes me straight into the web server. ... Can I clear what Windows has remembered so I get the ... Have you tried logging in from a command prompt? ... May at least prove if the username/password are ok and you can connect, ...
      (uk.people.silversurfers)
    • Re: Disabling Internet Explorer "Save my password" checkbox for httpauthentication
      ... What you are asking for is available in Group Policy ... User configuration\Windows Settings\Internet Explorer Maintenance ... This site requires http authentication, ... machine is then prompted for the http authentication username/password ...
      (Focus-Microsoft)
    • Re: ASP security (anonymouse vs integrated) problem...
      ... displays a login page and requests a username/password combination. ... they have already logged-on to windows. ... redirect to the standard login page for the username/password combination. ...
      (microsoft.public.inetserver.asp.general)
    • Re: Windows Authentication
      ... > Cor, just an FYI: ... > does NOT prompt for a Windows username/password. ... > custom username/password from a backend db or xml. ...
      (microsoft.public.dotnet.languages.vb)
    • RE: Best way to provide security when need a WindowsIdentity
      ... serializable - which is not a big problem when session is in-proc - ... throw away the username/password, and use that principal from then on ... then use windows authentication and all access of files and SSPI ... database queries is done under the WindowsIdentity of the user. ...
      (microsoft.public.dotnet.framework.aspnet.security)