Bugtraq mailing list archives
Re: Google Talk cleartext proxy credentials vulnerability
From: 3APA3A <3APA3A () SECURITY NNOV RU>
Date: Sat, 15 Oct 2005 23:40:08 +0400
Dear m123303 () richmond ac uk, Again and again. HKEY_CURENT_USER is accessible for user only. If one can access user's account he can recover _any_ stored password, because he can do everything user can. The only additional reason, storing password in registry is not good, is password can be easily recovered by someone with physical access to hard drive. It's only attack vector comparing with different password store, for example protected storage. --Friday, October 14, 2005, 3:06:55 PM, you wrote to bugtraq () securityfocus com: mrau> talk.google.com and are located under mrau> HKEY_CURRENT_USER\Software\Google\Google mrau> Talk\Accounts\[username]@gmail.com\pw -- ~/ZARAZA Итак, я буду краток. (Твен)
Current thread:
- Google Talk cleartext proxy credentials vulnerability m123303 (Oct 14)
- Re: Google Talk cleartext proxy credentials vulnerability 3APA3A (Oct 15)