Skip to main content
added 709 characters in body
Source Link
Neil Smithline
  • 14.9k
  • 4
  • 40
  • 55

This seems weak protection for something as important as a password. Your solution is based on the assumption that just because you are the only user on your computer, everything that you execute is trusted. Unfortunately, this is not the case.

Windows User Account Control was created to help protect against the running of malicious code. But the random directory that you are using is not protected by UAC. So it is open to any process running under your user account.

Generally, passwords are considered so critical that they aren't even stored encrypted. Rather, irreversible hashes are used to store them. For example, Windows only stores a hash of your account's password. So, while I understand that you wish to have automated and easy access to your password, I think any security-conscious solution will require you to encrypt the password and provide a password at time of access.

One could argue that being that you're creating a one-off solution, nobody would think of looking in this directory for your password so you are safe. But this is just the old security through obscurity argument.

This seems weak protection for something as important as a password. Your solution is based on the assumption that just because you are the only user on your computer, everything that you execute is trusted. Unfortunately, this is not the case.

Windows User Account Control was created to help protect against the running of malicious code. But the random directory that you are using is not protected by UAC. So it is open to any process running under your user account.

This seems weak protection for something as important as a password. Your solution is based on the assumption that just because you are the only user on your computer, everything that you execute is trusted. Unfortunately, this is not the case.

Windows User Account Control was created to help protect against the running of malicious code. But the random directory that you are using is not protected by UAC. So it is open to any process running under your user account.

Generally, passwords are considered so critical that they aren't even stored encrypted. Rather, irreversible hashes are used to store them. For example, Windows only stores a hash of your account's password. So, while I understand that you wish to have automated and easy access to your password, I think any security-conscious solution will require you to encrypt the password and provide a password at time of access.

One could argue that being that you're creating a one-off solution, nobody would think of looking in this directory for your password so you are safe. But this is just the old security through obscurity argument.

Source Link
Neil Smithline
  • 14.9k
  • 4
  • 40
  • 55

This seems weak protection for something as important as a password. Your solution is based on the assumption that just because you are the only user on your computer, everything that you execute is trusted. Unfortunately, this is not the case.

Windows User Account Control was created to help protect against the running of malicious code. But the random directory that you are using is not protected by UAC. So it is open to any process running under your user account.