pagvac wrote: > Jaroslaw, > > thanks for your post. You're right, the same issue occurs in *many* > applications. However, any vendor that is serious about security will > at least attempt to obfuscate the credentials in memory (IMHO).
Thanks for your post too. I think you're right that obfuscation can help in some cases. Sometimes the plaintext credentials goes to the Microsoft as the part of the crash report. Then if the cerdentials are obfuscated, in a correct way, we can prevent Microsoft from collecting our credentials. To prevent an attacker from reading credentialas from process memory dump we need more complicated mechanism (the dump contains all data & code). Therefore cost of implementing the correct obfuscation might be uncomparable with the risk of the credential lost in such manner. That's why I think the obfuscation isn't necessary. But this is of course only my opinion:] > I published the advisory to let the public know that Google fixed this > problem, that's all. You're right and we're thankful for this. Better if the user knows how the application deals with his credentials. > However I respect your opinion and appreciate your post. As I respect your :] regards, js _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
