I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption process. Now, I've heard that there are tools (like Hieren's boot disk) that can crack Windows passwords "easily". Can DPAPI be counted on for any kind of security in the event that an attacker has physical access to the hard disk and the Windows password is decently complex? (Uppercase, lowercase, number, symbol 8+ length)
According to this book, the user password is expanded into an encryption key (for DPAPI) using the PBKDF1 key derivation function, configured to use SHA-1 with 4000 iterations by default. PBKDF1 is described in RFC 2898 (section 5.1). An attacker with a few big GPU could compute, perhaps, four billions SHA-1 per second, hence try about one million potential passwords per second. If your password has 8 random characters from an alphabet of size 64 (uppercase and lowercase letters, digits, and two symbols), then it has entropy 48 bits (because 648 = 248), and the attacker will need to try, on average, about 247 passwords before finding the right one. At one million passwords per second, this will take him about four years.
Beware that Windows has a habit of ignoring case in many places -- you should check whether uppercase and lowercase are indeed distinct as far as password verification is concerned.
(The book says "by default" which may imply that the "4000" parameter is configurable -- but I do not know how.)