BugTraq
Google Talk cleartext proxy credentials vulnerability Oct 14 2005 11:06AM
m123303 richmond ac uk (1 replies)
Re: Google Talk cleartext proxy credentials vulnerability Oct 15 2005 07:40PM
3APA3A (3APA3A SECURITY NNOV RU)
Dear m123303 (at) richmond.ac (dot) uk [email concealed],

Again and again. HKEY_CURENT_USER is accessible for user only. If one
can access user's account he can recover _any_ stored password, because
he can do everything user can.

The only additional reason, storing password in registry is not good, is
password can be easily recovered by someone with physical access to hard
drive. It's only attack vector comparing with different password store,
for example protected storage.

--Friday, October 14, 2005, 3:06:55 PM, you wrote to bugtraq (at) securityfocus (dot) com [email concealed]:

mrau> talk.google.com and are located under

mrau> HKEY_CURRENT_USER\Software\Google\Google
mrau> Talk\Accounts\[username]@gmail.com\pw

--
~/ZARAZA
Èòàê, ÿ áóäó êðàòîê. (Òâåí)

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus