The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?
-
1Windows? No, probably not. Why would it? Discord on the other hand, possibly.– user163495Mar 29, 2021 at 11:30
Add a comment
|
2 Answers
I do not believe Windows stores app credentials by default. But Windows CAN do almost anything you (or an attacker with sufficient access) tells it to.
I think it is important to distinguish credentials (your password) and session management (access to the application). These patterns and advice apply to most client-server applications.
Applications are free to implement credential management and session management however (securely) they want. Many have made mistakes.
"Remember me" functionality is usually session management... the client computer will store a token that is authorized to resume an existing session (without requiring credentials) on the server computer.
If an attacker can access that client token, they might be able to resume your server session. If an attacker gets your credentials, they might be able to start a new server session. Both scenarios are bad obviously.
Multifactor authentication, and not-using-untrusted-client-devices are good ways to protect your credentials. Secure transmission too obviously.
Session management is tougher, as most of it is invisible to the user, and is implemented many different ways. If you're worried, usually a password change on the server will invalidate previously created client sessions.
I hope this helps!
Windows stores computer login password using a hashing algorithm. Windows doesn't store external application credentials. But your password can be compromised if your friend has a keylogger on the computer.
If the application was set to save the password, it will be stored on the computer.
-
-
2@phbits That not entirely true. DPAPI merely encrypts data with a machine/user dependent key. Storage of the data is up to the application itself.– nobodyMar 29, 2021 at 20:08
-
@nobody - I understand your technical position and in that regard point out Credential Manager as an example. I chose the DPAPI wiki link as it's the core auth of Windows and lists products that use it. Felt that was more constructive considering the content of the post.– phbitsMar 29, 2021 at 22:51
-
@phbits i didn't aware about DPAPI, I read link you have posted. But there is no point related to question.– InfraMar 30, 2021 at 4:17