[40762] in bugtraq
Re: Google Talk cleartext proxy credentials vulnerability
daemon@ATHENA.MIT.EDU (3APA3A)
Sat Oct 15 16:22:23 2005
Date: Sat, 15 Oct 2005 23:40:08 +0400
From: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Reply-To: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Message-ID: <11817330.20051015234008@SECURITY.NNOV.RU>
To: m123303@richmond.ac.uk
Cc: bugtraq@securityfocus.com
In-Reply-To: <20051014110655.3795.qmail@securityfocus.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=Windows-1251
Content-Transfer-Encoding: 8bit
Dear m123303@richmond.ac.uk,
Again and again. HKEY_CURENT_USER is accessible for user only. If one
can access user's account he can recover _any_ stored password, because
he can do everything user can.
The only additional reason, storing password in registry is not good, is
password can be easily recovered by someone with physical access to hard
drive. It's only attack vector comparing with different password store,
for example protected storage.
--Friday, October 14, 2005, 3:06:55 PM, you wrote to bugtraq@securityfocus.com:
mrau> talk.google.com and are located under
mrau> HKEY_CURRENT_USER\Software\Google\Google
mrau> Talk\Accounts\[username]@gmail.com\pw
--
~/ZARAZA
Итак, я буду краток. (Твен)
