If you use Windows Explorer to open an FTP site that requires a password,
Explorer may display the password in clear text in the future through the
autocomplete feature in Explorer's Address bar. I've tried this on one XP
SP3 machine and the password DOES appear, but on another XP SP3 machine only
the username appears. Steps to reproduce:

1. Open Windows Explorer and if necessary enable the display of the Address
bar

2. In the Address bar, enter the URI of an FTP server that does not permit
anonymous access and on which you have an account, e.g.
ftp://host.domain.com/myfolder

3. Windows Explorer will prompt you for a username and password, and then
will display the folder contents

4. Close Windows Explorer, then open Windows Explorer again.

5. In the Address bar, type ftp:

At this point autocomplete should kick in and display the URI with at least
your username and maybe the password displayed in clear text, e.g.

ftp://username:password@host.domain.com/somefolder

The version with the username and password don't appear in the Address bar's
MRU dropdown, but just in prompts popped up by autocomplete. The password
does not seem to appear in plaintext in the Registry.

As I said, have one machine that reliably shows the password, and another
that doesn't.

Does anyone else find that the password is displayed?

(No need to discuss the insecurity of FTP itself--that's not the issue
here. This is about the potential for exposing previously used passwords on
the desktop)

Re: Windows Explorer may expose FTP passwords in plaintext by S

S
Fri Jul 18 20:11:43 CDT 2008

So the risk it that the user's own password is displayed to the user?

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

"Brian Knittel" <brian@quarterbyte.com> wrote in message
news:4880f85f$0$17195$742ec2ed@news.sonic.net...
> If you use Windows Explorer to open an FTP site that requires a password,
> Explorer may display the password in clear text in the future through the
> autocomplete feature in Explorer's Address bar. I've tried this on one XP
> SP3 machine and the password DOES appear, but on another XP SP3 machine
> only the username appears. Steps to reproduce:
>
> 1. Open Windows Explorer and if necessary enable the display of the
> Address bar
>
> 2. In the Address bar, enter the URI of an FTP server that does not permit
> anonymous access and on which you have an account, e.g.
> ftp://host.domain.com/myfolder
>
> 3. Windows Explorer will prompt you for a username and password, and then
> will display the folder contents
>
> 4. Close Windows Explorer, then open Windows Explorer again.
>
> 5. In the Address bar, type ftp:
>
> At this point autocomplete should kick in and display the URI with at
> least your username and maybe the password displayed in clear text, e.g.
>
> ftp://username:password@host.domain.com/somefolder
>
> The version with the username and password don't appear in the Address
> bar's MRU dropdown, but just in prompts popped up by autocomplete. The
> password does not seem to appear in plaintext in the Registry.
>
> As I said, have one machine that reliably shows the password, and another
> that doesn't.
>
> Does anyone else find that the password is displayed?
>
> (No need to discuss the insecurity of FTP itself--that's not the issue
> here. This is about the potential for exposing previously used passwords
> on the desktop)
>
>



Re: Windows Explorer may expose FTP passwords in plaintext by Stefan

Stefan
Sat Jul 19 11:45:49 CDT 2008

"S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote:

> So the risk it that the user's own password is displayed to the user?

Apparently you missed the point -- COMPLETELY!

1. A previously entered password must NEVER be displayed to any user.

2. Think of a shared computer in a public place.

Stefan


Re: Windows Explorer may expose FTP passwords in plaintext by Shenan

Shenan
Sat Jul 19 14:40:11 CDT 2008

Brian Knittel wrote:
> If you use Windows Explorer to open an FTP site that requires a
> password, Explorer may display the password in clear text in the
> future through the autocomplete feature in Explorer's Address bar.
> I've tried this on one XP SP3 machine and the password DOES appear,
> but on another XP SP3 machine only the username appears. Steps to
> reproduce:
> 1. Open Windows Explorer and if necessary enable the display of the
> Address bar
>
> 2. In the Address bar, enter the URI of an FTP server that does not
> permit anonymous access and on which you have an account, e.g.
> ftp://host.domain.com/myfolder
>
> 3. Windows Explorer will prompt you for a username and password,
> and then will display the folder contents
>
> 4. Close Windows Explorer, then open Windows Explorer again.
>
> 5. In the Address bar, type ftp:
>
> At this point autocomplete should kick in and display the URI with
> at least your username and maybe the password displayed in clear
> text, e.g.
> ftp://username:password@host.domain.com/somefolder
>
> The version with the username and password don't appear in the
> Address bar's MRU dropdown, but just in prompts popped up by
> autocomplete. The password does not seem to appear in plaintext in
> the Registry.
> As I said, have one machine that reliably shows the password, and
> another that doesn't.
>
> Does anyone else find that the password is displayed?
>
> (No need to discuss the insecurity of FTP itself--that's not the
> issue here. This is about the potential for exposing previously
> used passwords on the desktop)

Actually - I would say that the last paragraph/disclaimer is the issue.

FTP is a basic transfer method - old (should be obsolete in my opinion - and
is in many places) and natively insecure. If you are using ftp to transfer
anything - I would consider that an unwise decision and would not expect
anything you use to make the natively insecure protocol any better for you
and thus - the best alternative IMHO - is to just find a better method of
file transfer. (Unless you are just grabbing files you feel okay with being
transferred in such an open method.)

As for the other responder - if you are foolhardy enough to go to a public
computer and log into a private FTP site using Internet Explorer and
download something - I am without words to express ... I mean - wow. I
know - not everyone may be aware how insecure FTP is - but - those people
probably aren't using FTP anyway. (I agree with point (1) of yours, BTW -
although that is more a function of the way the information gets passed to
the site than the browser - as well as the browser cache settings, etc. In
the case of old/obsolete FTP, that way is insecure and horrible all the way
down the line.)

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



Re: Windows Explorer may expose FTP passwords in plaintext by Brian

Brian
Sat Jul 19 16:31:58 CDT 2008

Stefan got the point: a computer should never display a previously entered
password in clear text, no matter what, and I have observed Windows doing
just that.

Has anyone else observed this behavior following the steps I outlined?

Please add this additional step:

When you are viewing the remote FTP directory using Windows Explorer,
drag a file from the FTP directory onto your desktop. Then, close Explorer,
reopen it, and type ftp:// into the Address window. (I just noticed that
the
passwords I see are all on URIs that have filenames)

Could you please test this, and if you have a positive result (that is, you
see the password), please post a response. It would help if you noted your
version of Windows and Service Pack level.

Or, if you have a negative result, that is, you drag a file to your desktop,
and the next time you open Explorer and type ftp:// into the Address bar you
DO NOT see the password, please also post a response, if others haven't
already done so for your particular version+SP level of Windows.

Please, in the interest of keeping on topic, let's just focus on this one
behavior, and save discussions of network protocol security, public
computers and the like for another day.



Re: Windows Explorer may expose FTP passwords in plaintext by Stefan

Stefan
Sat Jul 19 16:54:27 CDT 2008

"Shenan Stanley" <newshelper@gmail.com> wrote:


> As for the other responder - if you are foolhardy enough to go to a public
> computer and log into a private FTP site using Internet Explorer and
> download something - I am without words to express ... I mean - wow.

*I* am no *such* fool, and I've noticed the "dislaimer" of Brian very well.

The point is NOT the FTP protocol, it's IE that discards one of the main
principles in handling credentials: NEVER EVER display a password in clear,
neither when input nor when prepopulating an input field with a stored one.

> I
> know - not everyone may be aware how insecure FTP is - but - those people
> probably aren't using FTP anyway.

The same people but might very well use POP3 or IMAP or SMTP (without SSL,
TLS, APOP etc.) on a public computer and send their credentials in cleartext.
Or they might use their laptop, connected to a public WLAN, and do the same.

I bet that *many* PC user's can't tell whether their email provider allows
SSL/TLS and whether their computer or laptop is configured to use encryption
on the wire to access their mailbox.

> (I agree with point (1) of yours, BTW -
> although that is more a function of the way the information gets passed to
> the site than the browser - as well as the browser cache settings, etc. In
> the case of old/obsolete FTP, that way is insecure and horrible all the way
> down the line.)

regards
Stefan


Re: Windows Explorer may expose FTP passwords in plaintext by Shenan

Shenan
Sat Jul 19 20:13:55 CDT 2008

Brian Knittel wrote:
> Stefan got the point: a computer should never display a previously
> entered password in clear text, no matter what, and I have observed
> Windows doing just that.
>
> Has anyone else observed this behavior following the steps I
> outlined?
> Please add this additional step:
>
> When you are viewing the remote FTP directory using Windows
> Explorer, drag a file from the FTP directory onto your desktop. Then,
> close
> Explorer, reopen it, and type ftp:// into the Address window. (I
> just noticed that the
> passwords I see are all on URIs that have filenames)
>
> Could you please test this, and if you have a positive result (that
> is, you see the password), please post a response. It would help if
> you noted your version of Windows and Service Pack level.
>
> Or, if you have a negative result, that is, you drag a file to your
> desktop, and the next time you open Explorer and type ftp:// into
> the Address bar you DO NOT see the password, please also post a
> response, if others haven't already done so for your particular
> version+SP level of Windows.
> Please, in the interest of keeping on topic, let's just focus on
> this one behavior, and save discussions of network protocol
> security, public computers and the like for another day.

I *know* it happens - because it's been doing that for years.
IE4, IE5, IE6 and I bet IE7.

It is not like this discussion is new. ;-)

Maybe where the password is displayed is (maybe) - but I am sure it has to
do with 'how the browser has to pass the credentials...' - so it may be a
direct result of the protocol rules of passing things in clear/plain text.

Internet Explorer 5, Netscape 4.61 Reveal FTP User Names and Passwords
http://www.astonisher.com/archives/bugnet/alerts/bugalert_81199.html
(1999)

Internet Explorer discloses FTP access credentials
http://www.heise-online.co.uk/security/Internet-Explorer-discloses-FTP-access-credentials--/news/94349
(2007)

Internet Explorer and Your Web Site's Privacy
http://blog.washingtonpost.com/securityfix/2007/08/ftp_files_expose_web_site_cred.html
(2007)


How to Enter FTP Site Password in Internet Explorer
http://support.microsoft.com/kb/135975
(OLD - since it mentioned Windows 95/98 - but last updated in 2007)

"NOTE: The user name and password you enter in the Login As dialog box are
passed through as plain text and may be displayed in the Internet Explorer
title bar or status bar while you are connected to the site.

Note that this is not a secure method of logging on, as the password is
viewable in plain text. If you require additional security, use the FTP
client (Ftp.exe) that is included in your version of Windows 95 or Windows
98."

Does FireFox do it?
Opera?
Any other browsers?

Or do some browsers not even do FTP because of the weak security and how
they would have to pass the username/password?

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



Re: Windows Explorer may expose FTP passwords in plaintext by Steve

Steve
Sat Jul 19 23:23:17 CDT 2008

Please understand the science here. If a protocol is insecure on the wire,
then there's zero benefit in trying to hide any aspects of that protocol
conversation on the individual computer itself. Besides, the displayed
password (retrieved from the URL history in this case) is displayed only to
the particular user who's logged on. If some other user logs onto the PC,
then that user can't see the first user's history (local admins excepted, of
course).

--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com



"Stefan Kanthak" <postmaster@[127.0.0.1]> wrote in message
news:OPc4dNd6IHA.2220@TK2MSFTNGP06.phx.gbl...
> "S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote:
>
>> So the risk it that the user's own password is displayed to the user?
>
> Apparently you missed the point -- COMPLETELY!
>
> 1. A previously entered password must NEVER be displayed to any user.
>
> 2. Think of a shared computer in a public place.
>
> Stefan
>

Re: Windows Explorer may expose FTP passwords in plaintext by Alun

Alun
Sun Jul 20 01:16:48 CDT 2008

"Steve Riley [MSFT]" <steve.riley@microsoft.com> wrote in message
news:0308CDD5-F4A5-4D1D-BE24-FC16111208DD@microsoft.com...
> Please understand the science here. If a protocol is insecure on the wire,
> then there's zero benefit in trying to hide any aspects of that protocol
> conversation on the individual computer itself. Besides, the displayed
> password (retrieved from the URL history in this case) is displayed only
> to the particular user who's logged on. If some other user logs onto the
> PC, then that user can't see the first user's history (local admins
> excepted, of course).

Your first two sentences are a bit of a copout, Steve.

Plenty of people use FTP securely - say, for instance, over an encrypted
VPN, or over IPsec.

As for the remaining sentences, it's worth noting that in most other places
where you enter a password, the password is blanked out, even though it is
indeed your own password.

The old "my password? yeah, it's eight stars" joke reminds us that
passwords, where they can be recognised as such, should always be hidden
from view. Otherwise, shoulder-surfing gets much easier.

Or are you planning on spreading this message throughout Windows, and having
the logon screen echo the password back to the user as they type it?

Alun.
~~~~
--
Texas Imperial Software | Web: http://www.wftpd.com/
23921 57th Ave SE | Blog: http://msmvps.com/alunj/
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.



Re: Windows Explorer may expose FTP passwords in plaintext by S

S
Sun Jul 20 03:42:11 CDT 2008

G'day:

"Stefan Kanthak" <postmaster@[127.0.0.1]> wrote in message
news:OPc4dNd6IHA.2220@TK2MSFTNGP06.phx.gbl...
> "S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote:
>
>> So the risk it that the user's own password is displayed to the user?
>
> Apparently you missed the point -- COMPLETELY!

No I didn't.

> 1. A previously entered password must NEVER be displayed to any user.

I don't see a problem if it's the user's own password.

> 2. Think of a shared computer in a public place.

It's not secure by definition, therefore mustn't be used by acessing
supposedly protected, personal information, via ftp or toherwise.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *



Re: Windows Explorer may expose FTP passwords in plaintext by Stefan

Stefan
Sun Jul 20 06:32:56 CDT 2008

"S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote:

> G'day:
>
> "Stefan Kanthak" <postmaster@[127.0.0.1]> wrote in message
> news:OPc4dNd6IHA.2220@TK2MSFTNGP06.phx.gbl...
>> "S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote:
>>
>>> So the risk it that the user's own password is displayed to the user?
>>
>> Apparently you missed the point -- COMPLETELY!
>
> No I didn't.

You did.-)

>> 1. A previously entered password must NEVER be displayed to any user.
>
> I don't see a problem if it's the user's own password.

So you won't see a problem if the login dialog/screen prints the users
password too?
Or any other dialog, for example in Outlook, Outlook Express, Windows
Mail, ..., where a "remembered" password can be used?
Get real!

>> 2. Think of a shared computer in a public place.
>
> It's not secure by definition, therefore mustn't be used by acessing
> supposedly protected, personal information, via ftp or toherwise.

The emphasis lies on THINK.
Please contruct another more appropriate example yourself, say: you
help your neighbor with his/her computer and login to one of yours
from said neighbors computer. Shall that password be displayed to
you neighbor?

Stefan


Re: Windows Explorer may expose FTP passwords in plaintext by Stefan

Stefan
Sun Jul 20 06:38:00 CDT 2008

"Steve Riley [MSFT]" <steve.riley@microsoft.com> wrote:

> Please understand the science here.

Which "science"?

> If a protocol is insecure on the wire,
> then there's zero benefit in trying to hide any aspects of that protocol
> conversation on the individual computer itself.

Why have MSFT programs like Internet Explorer, Outlook, Outlook Express
and Windows Mail then this useless feature with zero benefit to hide
passwords for "Basic HTTP Auth", POP3, IMAP or SMTP (with plain auth)?


Stefan


Re: Windows Explorer may expose FTP passwords in plaintext by Steve

Steve
Mon Jul 21 00:46:20 CDT 2008

I look at it this way... in the particular case of unencrypted FTP URLs,
since the "userid:password" portion of the URL will be logged in cleartext
in plenty of places besides the user's own profile, I don't see that there's
much additional risk here.

--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com



"Alun Jones" <alun@texis.invalid> wrote in message
news:49442919-8ED4-4B33-956C-D163B9CB0A4C@microsoft.com...
> "Steve Riley [MSFT]" <steve.riley@microsoft.com> wrote in message
> news:0308CDD5-F4A5-4D1D-BE24-FC16111208DD@microsoft.com...
>> Please understand the science here. If a protocol is insecure on the
>> wire, then there's zero benefit in trying to hide any aspects of that
>> protocol conversation on the individual computer itself. Besides, the
>> displayed password (retrieved from the URL history in this case) is
>> displayed only to the particular user who's logged on. If some other user
>> logs onto the PC, then that user can't see the first user's history
>> (local admins excepted, of course).
>
> Your first two sentences are a bit of a copout, Steve.
>
> Plenty of people use FTP securely - say, for instance, over an encrypted
> VPN, or over IPsec.
>
> As for the remaining sentences, it's worth noting that in most other
> places where you enter a password, the password is blanked out, even
> though it is indeed your own password.
>
> The old "my password? yeah, it's eight stars" joke reminds us that
> passwords, where they can be recognised as such, should always be hidden
> from view. Otherwise, shoulder-surfing gets much easier.
>
> Or are you planning on spreading this message throughout Windows, and
> having the logon screen echo the password back to the user as they type
> it?
>
> Alun.
> ~~~~
> --
> Texas Imperial Software | Web: http://www.wftpd.com/
> 23921 57th Ave SE | Blog: http://msmvps.com/alunj/
> Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
> Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.
>
>

Re: Windows Explorer may expose FTP passwords in plaintext by S

S
Mon Jul 21 05:18:17 CDT 2008

G'day:

"Stefan Kanthak"
<dont.delete-this.dont.remove-this.nospam@expires-2008-07-31.arcornews.de>
wrote in message
news:4883232f$0$6607$9b4e6d93@newsspool2.arcor-online.net...

> So you won't see a problem if the login dialog/screen prints the users
> password too?
> Or any other dialog, for example in Outlook, Outlook Express, Windows
> Mail, ..., where a "remembered" password can be used?

Not really. I find hiding my passwords from me very inconvenient at times.
Especially in case when it gets stored and transmitted to the destination in
clear - then it doesn't make sense at all.

>>> 2. Think of a shared computer in a public place.
>>
>> It's not secure by definition, therefore mustn't be used by acessing
>> supposedly protected, personal information, via ftp or toherwise.
>
> The emphasis lies on THINK.
> Please contruct another more appropriate example yourself, say: you
> help your neighbor with his/her computer and login to one of yours
> from said neighbors computer. Shall that password be displayed to
> you neighbor?

I avoid situations like that. Not by not helping those in need.

Kindly don't assume that your way of thinking is the only right one.
Printing in all capitals doesn't really prove anything.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *



Re: Windows Explorer may expose FTP passwords in plaintext by Alun

Alun
Mon Jul 21 09:59:46 CDT 2008

"Steve Riley [MSFT]" <steve.riley@microsoft.com> wrote in message
news:54DDFAE8-FFB4-4602-A4E1-ED414741F121@microsoft.com...
> I look at it this way... in the particular case of unencrypted FTP URLs,
> since the "userid:password" portion of the URL will be logged in cleartext
> in plenty of places besides the user's own profile, I don't see that
> there's much additional risk here.

I look at it this way... in the particular case of unencrypted FTP URLs,
browsers - Internet Explorer included - have been woefully remiss in
displaying and storing something that they know to be a password.

Perhaps it'd be a good idea to secure all of those places before
implementing FTPS.

Alun.
~~~~
--
Texas Imperial Software | Web: http://www.wftpd.com/
23921 57th Ave SE | Blog: http://msmvps.com/alunj/
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.



Re: Windows Explorer may expose FTP passwords in plaintext by Brian

Brian
Mon Jul 21 19:07:15 CDT 2008

Thanks, Shenan for the links. I'd done some googling on this before I posted
the original question and didn't find these.

So, it's a known, long-standing issue. And it's mind boggling that the
response is "besides, no body can see it." (Except maybe someone who walks
up and looks over your shoulder at your monitor, but hey).

Its interesting to note that Internet Explorer does not display the
password. Only Windows Explorer.

Anway, thanks. I'll see if I can find someone up at Redmond who cares about
this sort of stuff.

> It is not like this discussion is new. ;-)
>
> Maybe where the password is displayed is (maybe) - but I am sure it has to
> do with 'how the browser has to pass the credentials...' - so it may be a
> direct result of the protocol rules of passing things in clear/plain text.
>
> Internet Explorer 5, Netscape 4.61 Reveal FTP User Names and Passwords
> http://www.astonisher.com/archives/bugnet/alerts/bugalert_81199.html
> (1999)
>
> Internet Explorer discloses FTP access credentials
> http://www.heise-online.co.uk/security/Internet-Explorer-discloses-FTP-access-credentials--/news/94349
> (2007)
>
> Internet Explorer and Your Web Site's Privacy
> http://blog.washingtonpost.com/securityfix/2007/08/ftp_files_expose_web_site_cred.html
> (2007)
>
>
> How to Enter FTP Site Password in Internet Explorer
> http://support.microsoft.com/kb/135975
> (OLD - since it mentioned Windows 95/98 - but last updated in 2007)
>
> "NOTE: The user name and password you enter in the Login As dialog box are
> passed through as plain text and may be displayed in the Internet Explorer
> title bar or status bar while you are connected to the site.
>
> Note that this is not a secure method of logging on, as the password is
> viewable in plain text. If you require additional security, use the FTP
> client (Ftp.exe) that is included in your version of Windows 95 or Windows
> 98."
>
> Does FireFox do it?
> Opera?
> Any other browsers?
>
> Or do some browsers not even do FTP because of the weak security and how
> they would have to pass the username/password?
>
> --
> Shenan Stanley
> MS-MVP



Re: Windows Explorer may expose FTP passwords in plaintext by Anteaus

Anteaus
Wed Jul 23 03:56:00 CDT 2008

True, and it's a point that I've often emphasised is that Windows tends to be
faddist about theoretical considerations like repeatedly changing passwords,
and passwords of huge and totally unmemorable complexity, yet leaves a
blooper or two like this which makes the rest truly pointless!

The other point is that to say 'the user' is the only one who sees the
password assumes 'userization' of the computer. This is not always feasible.
In fact, this kind of arrangement is generally only practical with an AD
domain and roaming profiles. In smaller offices the tendency is to work with
a single fixed account regardless of actual user, since any other arrangement
causes too many problems with loss of program-settings.

Though, Windows is not the only OS to suffer this. In Linux' bash shell, try
typing 'su' and having this fail to be recognised, perhaps because of
existing garbage on the commandline. Then type the root password. It gets
stored in the bash history instead of being treated as a password. Once in
there it's suprisingly difficult to remove, too, unless you know some obscure
function-key strokes. Unlike in Windows, closing the commandprompt does no
good either, as the history persists between sessions. This one must be
decades old, yet it's never been addressed. It's an oh-so-easy way for an
engineer to unintentionally give a user the root logon.

"Brian Knittel" wrote:

> Stefan got the point: a computer should never display a previously entered
> password in clear text, no matter what, and I have observed Windows doing
> just that.


Re: Windows Explorer may expose FTP passwords in plaintext by S

S
Mon Jul 28 05:18:46 CDT 2008

And here's the difference: in Windows, I can have maximum-length, totally
random password that I don't know. That is, use smart card for
administrative functions. AD recovery password that is stored in the vault
is note really required all that often.

And I can set local administrator password to something random and don't
store it anywhere.

I have yet to see a UNIX system that allows smart card logon for equivalent
of root. Note that I'm not claiming that capability doesn't exist - only
outline the limit of my knowledge. I'd love to be educated if the
alternative exists.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

"Anteaus" <Anteaus@discussions.microsoft.com> wrote in message
news:E7304B3B-C41B-4A5D-B6FA-DECD11E6FCCD@microsoft.com...
> True, and it's a point that I've often emphasised is that Windows tends to
> be
> faddist about theoretical considerations like repeatedly changing
> passwords,
> and passwords of huge and totally unmemorable complexity, yet leaves a
> blooper or two like this which makes the rest truly pointless!
>
> The other point is that to say 'the user' is the only one who sees the
> password assumes 'userization' of the computer. This is not always
> feasible.
> In fact, this kind of arrangement is generally only practical with an AD
> domain and roaming profiles. In smaller offices the tendency is to work
> with
> a single fixed account regardless of actual user, since any other
> arrangement
> causes too many problems with loss of program-settings.
>
> Though, Windows is not the only OS to suffer this. In Linux' bash shell,
> try
> typing 'su' and having this fail to be recognised, perhaps because of
> existing garbage on the commandline. Then type the root password. It gets
> stored in the bash history instead of being treated as a password. Once in
> there it's suprisingly difficult to remove, too, unless you know some
> obscure
> function-key strokes. Unlike in Windows, closing the commandprompt does no
> good either, as the history persists between sessions. This one must be
> decades old, yet it's never been addressed. It's an oh-so-easy way for an
> engineer to unintentionally give a user the root logon.
>
> "Brian Knittel" wrote:
>
>> Stefan got the point: a computer should never display a previously
>> entered
>> password in clear text, no matter what, and I have observed Windows doing
>> just that.
>



Re: Windows Explorer may expose FTP passwords in plaintext by Brian

Brian
Fri Aug 01 13:00:46 CDT 2008

OK, to summarize this: the issue at hand is what happens when Windows
Explorer is given an FTP URL, prompts for a password, and unexpectedly
retains and displays it in plain text in the Address history dropdown. There
are four points to make:

1. The password prompt dialog does not display the password. It displays
bullets. This implies a contract with the user not to expose the password.

2. The password is stored and is recallable from the history even when the
user does NOT check the box "Save this password."

3. Internet Explorer does not display FTP passwords for which it has
prompted. Only Windows Explorer does this.

4. There is no other instance anywhere in Windows (or any other operating
system produced in the last 30 years), either in OS components or
application tools, where a password is stored in and is displayable in plain
text, even if the user wanted it to be. There are reasons for that, and
Windows Explorer alone disregards these reasons.

Any one of these points should be sufficient to make the case that this is
improper behavior and has to be fixed. The four taken together are beyond
compelling. Arguments that "FTP isn't secure anyway, so it's OK for Windows
to reveal the password," or "Only the logged in user can see the password
anyway" are completely beside the point. (And wouldn't have been so
disturbing but for the credentials of their sources).

So -- the people responsible for this at Microsoft have been asleep at the
switch, and nobody has called them to task? Surely this can't be beyond
Microsoft's ability to fix? And surely there's someone up there with enough
of a grasp of the importance of protecting passwords (and protecting user
confidence) to take it on?



Re: Windows Explorer may expose FTP passwords in plaintext by Shenan

Shenan
Fri Aug 01 14:26:13 CDT 2008

Brian Knittel wrote:
> OK, to summarize this: the issue at hand is what happens when
> Windows Explorer is given an FTP URL, prompts for a password, and
> unexpectedly retains and displays it in plain text in the Address
> history dropdown. There are four points to make:
>
> 1. The password prompt dialog does not display the password. It
> displays bullets. This implies a contract with the user not to
> expose the password.
> 2. The password is stored and is recallable from the history even
> when the user does NOT check the box "Save this password."
>
> 3. Internet Explorer does not display FTP passwords for which it has
> prompted. Only Windows Explorer does this.
>
> 4. There is no other instance anywhere in Windows (or any other
> operating system produced in the last 30 years), either in OS
> components or application tools, where a password is stored in and
> is displayable in plain text, even if the user wanted it to be.
> There are reasons for that, and Windows Explorer alone disregards
> these reasons.
> Any one of these points should be sufficient to make the case that
> this is improper behavior and has to be fixed. The four taken
> together are beyond compelling. Arguments that "FTP isn't secure
> anyway, so it's OK for Windows to reveal the password," or "Only
> the logged in user can see the password anyway" are completely
> beside the point. (And wouldn't have been so disturbing but for the
> credentials of their sources).
> So -- the people responsible for this at Microsoft have been asleep
> at the switch, and nobody has called them to task? Surely this
> can't be beyond Microsoft's ability to fix? And surely there's
> someone up there with enough of a grasp of the importance of
> protecting passwords (and protecting user confidence) to take it on?

In reference to your last paragraph...

Actually - I think it is more likely the, "many better file transfer methods
exist and better ways to use even this particular file transfer method exist
other than using a browser/windows explorer" that you want to dismiss as
"beside the point".

Anyway - this is a public newsgroup - for discussion purposes only. It will
be unlikely to prompt anyone to do anything. ;-)

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



Re: Windows Explorer may expose FTP passwords in plaintext by Paul

Paul
Fri Aug 01 19:20:15 CDT 2008

On Fri, 1 Aug 2008 14:26:13 -0500, Shenan Stanley wrote:



If you're going to do this:


> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html

And do this:

> In reference to your last paragraph...

Doesn't it behoove you to follow your own advice?

If you're responding to a specific paragraph, especially the last one, do
you really need to quote the entire article?


--
Paul Adare
MVP - Identity Lifecycle Manager
http://www.identit.ca
BPI: A 1960s term used to describe unmentionable parts of the anatomy, as
in
"you bet your bpi".

Re: Windows Explorer may expose FTP passwords in plaintext by S

S
Fri Aug 01 20:28:57 CDT 2008

G'day:

"Brian Knittel" <brian@quarterbyte.com> wrote in message
news:48934f4f$0$17160$742ec2ed@news.sonic.net...


> Any one of these points should be sufficient to make the case that this is
> improper behavior and has to be fixed. The four taken together are beyond
> compelling. Arguments that "FTP isn't secure anyway, so it's OK for
> Windows to reveal the password," or "Only the logged in user can see the
> password anyway" are completely beside the point. (And wouldn't have been
> so disturbing but for the credentials of their sources).

To me those are quite compelling points, and to the point. Casually
dismissing those is a good sign of the fact there's nothing to counter.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *



Re: Windows Explorer may expose FTP passwords in plaintext by ~BD~

~BD~
Sat Aug 02 02:40:20 CDT 2008

Maybe you should put *your* house in order, too, Paul! ;)

This page on your web site is refering to last year:-
http://www.identit.ca/events.html

Dave




Re: Windows Explorer may expose FTP passwords in plaintext by Shenan

Shenan
Sat Aug 02 10:25:18 CDT 2008

<snipped>
Want to read more?
http://groups.google.com/group/microsoft.public.security/browse_frm/thread/d15e6b0861171443/8d82fd27f703e5af#8d82fd27f703e5af



Paul Adare - MVP wrote:
> If you're going to do this:

Shenan Stanley wrote:
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html

Paul Adare - MVP wrote:
> And do this:

Shenan Stanley wrote:
> In reference to your last paragraph...

Paul Adare - MVP wrote:
> Doesn't it behoove you to follow your own advice?
>
> If you're responding to a specific paragraph, especially the last
> one, do you really need to quote the entire article?


If by article you mean the "last response in this entire conversation" -
then I can tell you why I left it whole.


Short answer:
You have to know the point-of-view of the person asking the questions being
referred to in order to understand the questions and answers I chose to
give. The background information needed to be left.


Longer answer:
The responder chose to put no reference to the entire conversation they were
responding to. This - to me - was a bad choice - but I respected it as they
made whole points, not really referencing much except to (and they stated
it) summarize the past conversation.

My response was directed at the last paragraph of questions by the poster;
however, the questions (and answers) would have no real context if I had
left out the parts above it (the summarization(s) the poster had written.)
Leaving the posters points in gave the necessary context - as they posted
that as a whole and I fully intended to leave it as a whole.

Many times people do not do this - they choose to pull things out of the
body of the message they are responding to and while their response makes
sense in that microcosm of their own creation - it may not address the
actual points the original person intended to get across. I was addressing
the concerns they had presented as a whole but made sure I pointed out I was
answering the questions they had given clearly in reference to the concerns
they had presented earlier.

After all - If I had only quoted only the last paragraph:
"So -- the people responsible for this at Microsoft have been asleep at the
switch, and nobody has called them to task? Surely this can't be beyond
Microsoft's ability to fix? And surely there's someone up there with enough
of a grasp of the importance of protecting passwords (and protecting user
confidence) to take it on?"

How do you know - out of just that - it is a discussion on (quoting the OP
earlier), "... Windows Explorer is given an FTP URL, prompts for a password,
and unexpectedly retains and displays it in plain text in the Address
history dropdown ..."? How would you know what I was referencing with the
part of my response, '... that you want to dismiss as "beside the
point"....'?

You could argue that if someone wanted to know more - they could find the
posting and read it in its entirety... However - given what I replied to and
quoted was small; that would have been choosing to leave out things, perhaps
for my own purpose, thereby creating my own microcosm from which to
answer... Or - putting it bluntly - I believed it would have been lazy and
inconsiderate to the original posters intentions. Not to mention, not
everyone knows how to locate entire archives of postings - thus why I
sometimes also post the Google Groups link (such as now) to the archival of
the post in its entirety at the beginning of the response. ;-)

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



Re: Windows Explorer may expose FTP passwords in plaintext by Alun

Alun
Sat Aug 02 23:35:05 CDT 2008

"S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote in message
news:#PuEq8D9IHA.4004@TK2MSFTNGP03.phx.gbl...
> "Brian Knittel" <brian@quarterbyte.com> wrote in message
> news:48934f4f$0$17160$742ec2ed@news.sonic.net...
>> Any one of these points should be sufficient to make the case that this
>> is improper behavior and has to be fixed. The four taken together are
>> beyond compelling. Arguments that "FTP isn't secure anyway, so it's OK
>> for Windows to reveal the password," or "Only the logged in user can see
>> the password anyway" are completely beside the point. (And wouldn't have
>> been so disturbing but for the credentials of their sources).
>
> To me those are quite compelling points, and to the point. Casually
> dismissing those is a good sign of the fact there's nothing to counter.

Whether you feel those are compelling points or not, it's worth noting that
the behaviour for FTP is different from any other protocol for which you can
make similar assertions.

Enter a password into Basic Authentication over HTTP - that's exactly
equivalent to an unprotected password over FTP. And yet the credentials are
not stored, they are not available through the history interface to the
user, and they are not displayed to the user.

It is only the FTP implementation - and only the implementation in Windows
Explorer - where this approach to password storage and display is made,
despite there being numerous other protocols that are at least as weak.

There are two debates here:
1. I disagree with your suggestion that it's fine to display passwords "to
the user", as if there is no concern about shoulder-surfing.
2. The operating system is being inconsistent, when you compare FTP against
similarly unsecure protocol implementations.

Brian's interested in addressing debate 2. Debate 1 is a different issue
altogether.

Alun.
~~~~
--
Texas Imperial Software | Web: http://www.wftpd.com/
23921 57th Ave SE | Blog: http://msmvps.com/alunj/
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.



Re: Windows Explorer may expose FTP passwords in plaintext by Brian

Brian
Mon Aug 04 14:29:31 CDT 2008

Alun got the point. Windows Explorer is breaking the contract Windows makes
with the user not to display OR store the password. The first contract is
implicit: the password is obscured when it's entered in the
username/password prompt, so it should remain obscured. The second contract
is explicit, because the "Save this password" box can be left unchecked, yet
the password is still retained.

That's what I meant when I said that arguments about FTP's security are
beside the point. Those arguments don't NEED to be countered in
this discussion of the user interface bugs, because, as Alun understood,
it's a different debate. I might be using an-encrypted-over-the-wire network
for all anyone knows. The user interface is still broken (that's fact, not
opinion), and it's broken in a really bad way (that's my opinion).

It seemed pretty simple to me when I started this thread:

* The "save password" box should be respected.

* Since I never put my password into the URL I typed, Windows Explorer
shouldn't be putting it into the URL it stores in the history. The
associated password, IF I request it to be stored, should be enrypted and
stored elsewhere. There is a credential management system in Windows for
this sort of thing. Windows Explorer should use it.

That's all I'm saying. Are these bugs really worth defending?

> Whether you feel those are compelling points or not, it's worth noting
> that the behaviour for FTP is different from any other protocol for which
> you can make similar assertions.
..
> It is only the FTP implementation - and only the implementation in Windows
> Explorer - where this approach to password storage and display is made,
> despite there being numerous other protocols that are at least as weak.
>
> There are two debates here:
> 1. I disagree with your suggestion that it's fine to display passwords "to
> the user", as if there is no concern about shoulder-surfing.
> 2. The operating system is being inconsistent, when you compare FTP
> against similarly unsecure protocol implementations.
>
> Brian's interested in addressing debate 2. Debate 1 is a different issue
> altogether.
>
> Alun.



Re: Windows Explorer may expose FTP passwords in plaintext by S

S
Wed Aug 06 03:18:27 CDT 2008

G'day:

"Brian Knittel" <brian@quarterbyte.com> wrote in message
news:4897589a$0$17210$742ec2ed@news.sonic.net...
> Alun got the point. Windows Explorer is breaking the contract Windows
> makes with the user not to display OR store the password.

There's no such contract. You cannot store ftp password using irreversible
encryption.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *



Re: Windows Explorer may expose FTP passwords in plaintext by Alun

Alun
Wed Aug 06 09:45:22 CDT 2008

"S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote in message
news:OlXtE059IHA.5928@TK2MSFTNGP05.phx.gbl...
> G'day:
>
> "Brian Knittel" <brian@quarterbyte.com> wrote in message
> news:4897589a$0$17210$742ec2ed@news.sonic.net...
>> Alun got the point. Windows Explorer is breaking the contract Windows
>> makes with the user not to display OR store the password.
>
> There's no such contract. You cannot store ftp password using irreversible
> encryption.

Brian's already stated that there is a box that he chooses not to check,
that says "Save this password".

Brian does not want the password to be stored - reversibly or otherwise.

Alun.
~~~~
--
Texas Imperial Software | Web: http://www.wftpd.com/
23921 57th Ave SE | Blog: http://msmvps.com/alunj/
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.



Re: Windows Explorer may expose FTP passwords in plaintext by Brian

Brian
Wed Aug 06 23:36:22 CDT 2008

>> Alun got the point. Windows Explorer is breaking the contract Windows
>> makes with the user not to display OR store the password.
>
> There's no such contract. You cannot store ftp password using irreversible
> encryption.

You're quite correct, irreversible encryption cannot be used, since the FTP
protocol requires transmission of the unencrypted password to the server.

But I don't believe that that has anything to do with the issue at hand.
Password storage and UI behavior are two completely independent things.

First, the UI behavior: the display contract is implied when the UI obscures
the password during entry, displaying bullets instead of letters. This sets
up an expectation that the UI won't later visibly display the password in
the clear. I'm arguing that this expectation is reasonable and significant;
it has to be taken seriously and met. What do those dots in the password
dialog box mean, if not, "this password is going to be kept hidden?" The
dots in the password prompt lose their meaning if it turns out that
depending on the protocol and the program you use, Windows might show the
password again, or it might not. You get to guess when and how. If the UI
can't be trusted to behave consistently, should I also be worried that
Windows is going to display my online banking password when I'm least
expecting it? The passwords to the domain servers I manage? Displaying the
password after the UI has signalled that the password is going to be kept
secret is a betrayal of trust. I was completely taken aback when I saw it --
and I've seen more than my share of gory UI train wrecks.

(Again: I'm talking about how the UI interacts with me, not with how Windows
interacts with the remote server--keeping an FTP password secure in that
interaction is different realm of responsibility. And for this converssation
I'm assume that the user checked "Save this password." That Explorer retains
the password when the box isn't checked is also a separate issue).

Now, second, implementation. Yes, reversible encryption has to be used, just
as IE has to reversibly encrypt the passwords it memorizes for websites via
the autocomplete feature. I notice that there is no way to display any of
_those_ stored passwords in the clear, yet they're not encrypted when sent
over the wire either. Why should FTP be treated any differently, and only by
Windows Explorer? The FTP URL should be put into Explorer's history list,
yes, but the username and password that it prompts for should be reversibly
encrypted and stored as metadata associated with -- but not displayed
with -- the URL.

Given that (a) every other program maintains the veil around passwords and
(b) mechanisms for storing and recovering passwords separately from the URL
history exist and (c) Internet Explorer uses them and demonstrates that it's
not necessary for Windows Explorer to do this, and (d) Explorer's
functionality can be maintained without deviating from consistent UI
behavior, why should Windows Explorer be let off the hook?

Why defend the behavior? Does it serve a purpose, is there a reason that it
should be retained?

And if there is any ambivalence about whether the behavior is acceptable,
shouldn't the error be on the side of better security and more conservative
handling of credentials, rather than less?

Brian