3 ms·
The windows crypto APIs can encrypt secrets secured by the windows account. This would protect against attacks by other users on the system who don't have permi
by clinta 11y ago
The windows crypto APIs can encrypt secrets secured by the windows account. This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it, as well as protect against offline reading of the files.
It doesn't stop every attack, but it's not useless.
- gruez 11y ago>This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it Outside of enterprise environments, most windows installations are single user. Even if it's a multi-user system, the data would already be protected by NTFS permissions if it was stored in the user's profile folder. >as well as protect against offline reading of the files no, it doesn't[1][2] [1] http://passcape.com/windows_password_recovery_dpapi_decoder http://passcape.com/windows_password_recovery_dpapi_decoder [2] http://www.dpapick.com/ http://www.dpapick.com/
- clinta 11y agoThose tools require the users windows password to decrypt the encrypted blob. So yes, it does protect against offline reading of the files.