Обращение с паролями в приложениях

Разработка Far.
pepak
Posts: 604
Joined: Sun 13 Jul, 2008 11:18
Has thanked: 17 times
Been thanked: 54 times

Обращение с паролями в приложениях

Post by pepak »

Latest post of the previous page:

I agree with Ariman:

1) Save the passwords in a separate database, encrypted with a master key.
2) The master key should be randomly generated and also encrypted. As for the key to this, give the user a choice:
a) Password entered by the user on first access in the session.
b) Password read from the Windows credential store.
c) Password read from DPAPI.
d) Key decrypted using a private key stored in the Windows certificate store (this will give the user an opportunity to store the data on a smartcard).
3) In all of the cases above, if you are using a password (=user-entered data rather than randomly generated), process it using a secure (and slow!) key derivation function (e.g. Argon or scrypt - with user-configurable parameters).
4) When the user asks for a protected password for the first time in a session, read whatever data is necessary to decrypt the master key and, based on configuration:
a) Forget it after first use.
b) Forget it after the specified number of seconds since the last use.
c) Forget it when Windows session is locked.
d) Keep it in memory indefinitely.
e) Provide a UI to forget the remembered value right now.
2useven10
Posts: 5211
Joined: Mon 07 Sep, 2009 10:40
Has thanked: 18 times
Been thanked: 310 times

Обращение с паролями в приложениях

Post by 2useven10 »

DrKnS wrote: Thu 30 Dec, 2021 00:11 Написать код, который будет вытаскивать все из wincred и отправлять куда-то по http не просто, а очень просто.
Ну не всё там так уж просто, скажем сохранённые пароли RDС CredEnumerate() не отдаёт. Хотя netpass от NirSoft их тем не менее умеет показывать.
Post Reply

Return to “Development”