1

The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?

1
  • 1
    Windows? No, probably not. Why would it? Discord on the other hand, possibly. – MechMK1 Mar 29 at 11:30
1

I do not believe Windows stores app credentials by default. But Windows CAN do almost anything you (or an attacker with sufficient access) tells it to.

I think it is important to distinguish credentials (your password) and session management (access to the application). These patterns and advice apply to most client-server applications.

Applications are free to implement credential management and session management however (securely) they want. Many have made mistakes.

"Remember me" functionality is usually session management... the client computer will store a token that is authorized to resume an existing session (without requiring credentials) on the server computer.

If an attacker can access that client token, they might be able to resume your server session. If an attacker gets your credentials, they might be able to start a new server session. Both scenarios are bad obviously.

Multifactor authentication, and not-using-untrusted-client-devices are good ways to protect your credentials. Secure transmission too obviously.

Session management is tougher, as most of it is invisible to the user, and is implemented many different ways. If you're worried, usually a password change on the server will invalidate previously created client sessions.

I hope this helps!

0

Windows stores computer login password using a hashing algorithm. Windows doesn't store external application credentials. But your password can be compromised if your friend has a keylogger on the computer.

If the application was set to save the password, it will be stored on the computer.

4
  • Windows has the ability to store application passwords via DPAPI. This post is not a good answer. More appropriate as a comment. – phbits Mar 29 at 18:56
  • 2
    @phbits That not entirely true. DPAPI merely encrypts data with a machine/user dependent key. Storage of the data is up to the application itself. – nobody Mar 29 at 20:08
  • @nobody - I understand your technical position and in that regard point out Credential Manager as an example. I chose the DPAPI wiki link as it's the core auth of Windows and lists products that use it. Felt that was more constructive considering the content of the post. – phbits Mar 29 at 22:51
  • @phbits i didn't aware about DPAPI, I read link you have posted. But there is no point related to question. – Infra Mar 30 at 4:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.