6 ms·
What's 'secure credential storage'? I don't think the Windows Credential Management API counts. Any program running as my user can ask for credentials out of th
by yrro 4y ago
What's 'secure credential storage'? I don't think the Windows Credential Management API counts. Any program running as my user can ask for credentials out of the store, can't it?
And even if there was such a secure storage location, any program running as my user can read the token out of /proc/<teams PID>/mem; or it can ptrace(2) Teams and extract the token from the communication with the credential storage API...
- ezfe 4y agoAt least on macOS, the answer is no - a user alert indicating the application is asking to read the credentials will appear with a password field to grant access.
- magicalhippo 4y agoOn Windows an application using the Data Protection API can force the decrypt procedure to show a dialog[1]. Though I haven't checked if the dialog is run in a secure context, like for example the UAC dialog is. And I don't know if the dialog contains any information identifying the processing asking. If the dialog is just run in the normal context, or doesn't inform the user who wants to decrypt the data, it's not that useful for thwarting an attack I suppose. [1]: https://docs.microsoft.com/en-us/windows/win32/api/dpapi/ns-dpapi-cryptprotect_promptstruct https://docs.microsoft.com/en-us/windows/win32/api/dpapi/ns-...