Re: How to securely store a password on a PC
- From: "Paul Baker [MVP, Windows Desktop Experience]" <paulrichardbaker@xxxxxxxxxxxxxxxx>
- Date: Thu, 15 Jan 2009 17:41:33 -0500
I am no expert on these things but my first thought was to use Windows Data
Protection (DPAPI) to encrypt it such that the password list is available
only to the account running the service, the password for which should be
very strong, frequently changing and not shared.
http://msdn.microsoft.com/en-us/library/ms995355.aspx
Could the service remove the debug privilege so it cannot be debugged?
Security is not about the secrecy of the algorithm. That always has a good
potential of becoming known. All this really does is prevent someone from
figuring out it is using DPAPI. They could easily guess that it does.
Without being able to authenticate as the account running the service, the
data cannot be decrypted and if an administrator was able to get access to
the encrypted data then so what? It's encrypted.
Honestly, I've never used it and don't know how it works. Perhaps this will
inspire someone who DOES know to step forward with details of how it might
work or an explanation of why it will not.
Paul
"lelteto" <lelteto@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:B9B37802-90DD-4111-A9FE-9AA5F2A57CDC@xxxxxxxxxxxxxxxx
You simply CANNOT. The short reason is that an admin can always DEBUG your
service and can find the point when the password is retrieved / used
within
the service's code. Same goes for trying to protect against anybody having
full physical access to the computer. Eventually - since ALL information
needed for run your service, and, hence, ALL information needed to get to
the
password - an attacker could find the password and decrypt the data.
On the other hand, if you just want to protect it from other users, you
can
simply use access control (ACLs) - either on the data file or on the
password
file.
That doesn't mean you cannot make it harder to an attacker to find it. You
can use code obfuscation, password obfuscation, etc. But that just
increases
the work factor and ultimately does NOT provide protection.
Laszlo Elteto
SafeNet, Inc.
"Sebastian Daser" wrote:
Hi All,
I would like to write an application consisting of two components: The
first
one should be a GUI that allows a user to encrypt and store a file on a
PC
(using a provided password or the users Windows password or a security
token), the second component should be a service (running on the same PC)
that is able to decrypt the file using the previously provided password,
the
users password or security token).
My problem: How can I store the provided password securely on the PC (for
use by the service) in a way that other users (even administrators) are
not
able to acquire it, even if they try to reverse engineer or disassemble
the
application?
Is there a way for an application running on the user's account to
acquire
the users password or some sort of a security token which cannot be
acquired
by other users (even administrators)?
Which .NET framework assemblies may be used to accomplish the tasks?
Any help would be most appreciated!
Thanks and best regards
Sebastian Daser
Softfount IT Solutions
.
- Follow-Ups:
- Re: How to securely store a password on a PC
- From: lelteto
- Re: How to securely store a password on a PC
- Prev by Date: RE: Cannot decrypt files encrypted using Crypto API on a different
- Next by Date: Re: How to securely store a password on a PC
- Previous by thread: Cannot decrypt files encrypted using Crypto API on a different mac
- Next by thread: Re: How to securely store a password on a PC
- Index(es):
Relevant Pages
|
