-----BEGIN PGP SIGNED MESSAGE-----
Querisoft's SecureFile v1.0 Beta for Windows NT and Windows 95 (with IE 3.x) is now available for download from http://www.querisoft.com/securefile.html. This is one of the first client applications that uses Microsoft's CAPI 2.0 (beta)
Umm... reading your faq... (http://www.querisoft.com/SFFAQ.html) you state that you use the windows95 user password as the password for encrypting files. You also seem to imply that you don't actually _ask_ for the password, windows gives it to you (albeit hashed or something already, I imagine). If that is the case, that is extremely worrisome. In fact it's outrageous. That would imply that any _other_ application, benign or evil, could also access the same password and immediately decrypt files. Is that so? (Not coding much on windows, I don't know if applications can access the user's hashed or encrypted password, but I would guess they could.) Jeremey. - -- =-----------------------------------------------------------------------= Jeremey Barrett VeriWeb Internet Corp. Crypto, Ecash, Commerce Systems http://www.veriweb.com/ PGP Key fingerprint = 3B 42 1E D4 4B 17 0D 80 DC 59 6F 59 04 C3 83 64 =-----------------------------------------------------------------------= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMyA7YS/fy+vkqMxNAQGVSAP/dc1ZwWdfdJZ8gfJNUY3tias5LZi3pWzf NihyMClArDG7Nb+XQ+s+EILi+FCMCJgtnxoc5AYGW/M/2YlHq9P0ZsUG/PQCgP9x 3+rHi8Zl2BIEqhbkKh0RfAo1Ag6/gSygpTKJz+jQCb440FpTT1CpFCKyN5HSNczc ZuJwhM4Fzi4= =ao2E -----END PGP SIGNATURE-----
Jeremey Barrett wrote:
Umm... reading your faq... (http://www.querisoft.com/SFFAQ.html) you state that you use the windows95 user password as the password for
encrypting files. You also seem to imply that you don't actually _ask_ for the password, windows gives it to you (albeit hashed or something already, I imagine). If that is the case, that is extremely worrisome. In fact it's outrageous.
That would imply that any _other_ application, benign or evil, could also access the same password and immediately decrypt files.
Is that so? (Not coding much on windows, I don't know if applications can access the user's hashed or encrypted password, but I would guess they could.)
SecureFile is not using the Win 95 password for encrypting the files. Win 95 or Win NT never hands over the password to any application. CAPI 2.0 is so nicely integrated with the OS that unless you have logged in you wont get access to you keys. Now SecureFile is CAPI 2.0 based application, so to use SecureFile you have to log in. Once this is done the crypto operations (encryption/signing) etc are performed using your keys. The advantage you gain is that, a separate SecureFile logon is not required and nobody but you will be able to access your keys as they are protected by the OS. The SecureFile setup ensures that on Win 95 you have actually logged in and that you are working in the "Multiple Profiles" mode. Thank you for your interest in SecureFile. Please feel free to ask any questions you may have. Anand Abhyankar SecureFile Team Querisoft Systems Pvt. Ltd.
-----BEGIN PGP SIGNED MESSAGE----- Anand Abhyankar wrote:
SecureFile is not using the Win 95 password for encrypting the files. Win 95 or Win NT never hands over the password to any application.
Good.
CAPI 2.0 is so nicely integrated with the OS that unless you have logged in you wont get access to you keys. Now SecureFile is CAPI 2.0 based application, so to use SecureFile you have to log in. Once this is done the crypto operations (encryption/signing) etc are performed using your keys.
The advantage you gain is that, a separate SecureFile logon is not required and nobody but you will be able to access your keys as they are protected by the OS.
Out of curiosity, do you know how the keys are protected by windoze itself? I have the CAPI cd but have had all of 5 minutes to look at it. I would presume they're hashing your password into a key and then encrypting with it, or encrypting another key with it. Any idea? What is somewhat bothersome (and this would go for anything using CAPI in the way your product does) is the reliance upon the windoze password. If that were compromised, it seems all other CAPI integrated keys would also be compromised. Let's hope they choose good passwords, and know not to re-use the same one on the net somewhere. :-) (BTW, does windoze allow arbitrary length passwords or phrases, or does it have a short limit?) Jeremey. - -- =-----------------------------------------------------------------------= Jeremey Barrett VeriWeb Internet Corp. Crypto, Ecash, Commerce Systems http://www.veriweb.com/ PGP Key fingerprint = 3B 42 1E D4 4B 17 0D 80 DC 59 6F 59 04 C3 83 64 =-----------------------------------------------------------------------= -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMyKP5y/fy+vkqMxNAQHayQQAlQ1URquOTf0LNqX4Gsw340KRNsz+e4hk hJDaw61vNzWV7oCQtZeTYrpWYnf9nuZ0r3qaTGHE8b+s3whAEz7iXtS/DzNXz3dQ 0fce/EW9oMHjZa9xiilPb4FMbRMJJFShJ2WUSP/ZuMkaKXVftu5UG5I/FHxhpt+g A4sqBEOangQ= =PLfS -----END PGP SIGNATURE-----
Jeremey Barrett wrote:
Out of curiosity, do you know how the keys are protected by windoze itself?
I am sorry I dont understand you question.
I have the CAPI cd but have had all of 5 minutes to look at it. I would presume they're hashing your password into a key and then encrypting with it, or encrypting another key with it. Any idea?
Your Windows password is not used to actually any data. The Windows login just lets you access your keys. This way even if you change your Windows password it will not affect yout CAPI installation. As long as the OS identifies you it lets you access your keys.
What is somewhat bothersome (and this would go for anything using CAPI in the way your product does) is the reliance upon the windoze password. If that were compromised, it seems all other CAPI integrated keys would also be compromised. Let's hope they choose good passwords, and know not to re-use the same one on the net somewhere. :-)
Yes! you are right. Security without a good policy is an open door.
(BTW, does windoze allow arbitrary length passwords or phrases, or does it have a short limit?)
This can be configured by the administrator of the domain.
Jeremey.
Thank you for your interest in SecureFile. Please feel free to ask any questions you may have. Anand Abhyankar -- \|||/ ( O-O ) *----------------*-----------*--------.ooo0--(_)-0ooo.----------* Anand Abhyankar Querisoft Systems Pvt. Ltd. Email : anand@querisoft.com 810, Sindh Society, Aundh, Phone (Off) : 91-212-385925 Pune - 411 007. INDIA (Res) : 91-212-351023 .oooO ( ) Oooo. *----------------*-----------*------------\ (----( )----------* \_) ) / (_/
participants (2)
-
Anand Abhyankar -
Jeremey Barrett