4 ms·
Windows has a CryptProtectMemory() function [1] that can be used to encrypt in-memory secrets using an OS-allocated session key. As far as I know the key is sto
by andyjohnson0 13y ago
Windows has a CryptProtectMemory() function [1] that can be used to encrypt in-memory secrets using an OS-allocated session key. As far as I know the key is stored in non-paged memory in kernel memory space.
On Linux, libgcrypt can do encrypted malloc, which might also help.
[1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa380262(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/aa38...
- Fasebook 13y agoWe store passwords' one-way hash + salt only, we don't even know what our users' password are, they are never in memory to begin with. Even if someone got access to the stored value in memory somehow, they wouldn't know what to input to get that result for some time.
- kiernan 13y agoI think this is worrying more about things like database passwords and API keys used by your application.