Re: Plain text password for Microsoft (icwip.dun)

From: Roland Postle (mail@blazde.co.uk)
Date: 07/09/02 

From: "Roland Postle" <mail@blazde.co.uk>
To: <vuln-dev@securityfocus.com>
Date: Tue, 9 Jul 2002 21:38:12 +0100

> > Recommendations
> > ---------------
> > Store passwords in an encrypted form
>
> How are you gonna accomplish this since the password has to go 'over the
> wire' in plaintext? To be able to authenticate with the password you need
to
> be able to decrypt it.. right?

'Storing' the password in encrypted form would be quite easy to accomplish,
and it would at least stop the casual snooper. You could argue that the same
passwords /are/ encrypted when they're put in the registry, so why not in
.ins files too? It increases the security a tad.

Anyway, for a complete solution I think we should wait for... Palladium and
TCPA-based modems.

- Blazde

Relevant Pages

  • Re: Plain text password for Microsoft (icwip.dun)
    ... > 'Storing' the password in encrypted form would be quite easy to accomplish, ... The question with Palladium is twofold, how quickly it can be brought to ... Somehow it rings here inline with the old try at the crypto chips a few ...
    (Vuln-Dev)
  • Re: Plain text password for Microsoft (icwip.dun)
    ... > Store passwords in an encrypted form ... How are you gonna accomplish this since the password has to go 'over the ... wire' in plaintext? ...
    (Vuln-Dev)