Most browsers provide an option to save login-data for later use.
Suppose a Windows workstation is located in a well-protected corporate LAN and only a well-defined set of application can be launched with a well restricted set of changeable in-app options.
In other words: No one is able to run arbitrary applications.
I wonder, how secure login-data is, which browsers save:
- Will this data get encrypted using the current Windows login security token?
- Will only the owner of the Windows account be able to access it?
- Are they - assuming practical compute-power - secure?
- Should a web-app propose not to save login-data in browser.
- Can a web-app even reject login-data to be saved by browsers?
Practical means this: Not having enormous compute power or a Copacobana system.
- If not secure: Should no user ever store login data?
- If secure: Should user be instructed to save login data and afterwards eliminate the media by which the password was transferred to him.