bugtraq - Re: Google Talk cleartext proxy credentials vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <11817330.20051015234008@SECURITY.NNOV.RU>
Date: Sat, 15 Oct 2005 23:40:08 +0400
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: m123303@...hmond.ac.uk
Cc: bugtraq@...urityfocus.com
Subject: Re: Google Talk cleartext proxy credentials vulnerability

Dear m123303@...hmond.ac.uk,

Again  and  again.  HKEY_CURENT_USER is accessible for user only. If one
can  access user's account he can recover _any_ stored password, because
he can do everything user can.

The only additional reason, storing password in registry is not good, is
password can be easily recovered by someone with physical access to hard
drive.  It's only attack vector comparing with different password store,
for example protected storage.

--Friday, October 14, 2005, 3:06:55 PM, you wrote to bugtraq@...urityfocus.com:

mrau> talk.google.com and are located under

mrau> HKEY_CURRENT_USER\Software\Google\Google
mrau> Talk\Accounts\[username]@gmail.com\pw

-- 
~/ZARAZA
Итак, я буду краток. (Твен)