4 ms·

Don't keep plaintext passwords in memory; treat them like you'd treat your persistent records (e.g. database), because it is one.

• johncolanduoni 10y ago
  Issuing a disk read every time you need to decrypt data sent over a VPN is not feasible in the slightest. At best you could only keep the key derived from the password, but that's all you'd need to decrypt the traffic.
  • mikegerwitz 10y ago
    I was referring to the password used to log in. You can store a hash in memory for comparison.
    • johncolanduoni 10y ago
      This attack doesn't involve a login password. It's a pre-shared key. If you have the hash, you can both connect and decrypt the connections of others. If it was only needed for comparison, the plaintext password shouldn't even be in a database.
      • mikegerwitz 10y ago
        > Brian Waters, another security researcher, tested BENIGNCERTAIN on his own hardware and managed to obtain the VPN's password, also known as a preshared key. > On Friday, he tweeted a message of the output from his test, which revealed his test password of “password123” among a list of two other possibilities. A password and a pre-shared key can mean the same thing depending on context. Regardless of what it is, the value in memory should not be able to be used externally to log into the system. The article references "password123"---that should not be recoverable from memory.