|
Posted by S. Pidgorny on July 18, 2008, 9:11 pm
If you were Registered and logged in, you could reply and use other advanced thread options
So the risk it that the user's own password is displayed to the user?
--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-
* http://sl.mvps.org * http://msmvps.com/blogs/sp *
> If you use Windows Explorer to open an FTP site that requires a password,
> Explorer may display the password in clear text in the future through the
> autocomplete feature in Explorer's Address bar. I've tried this on one XP
> SP3 machine and the password DOES appear, but on another XP SP3 machine
> only the username appears. Steps to reproduce:
>
> 1. Open Windows Explorer and if necessary enable the display of the
> Address bar
>
> 2. In the Address bar, enter the URI of an FTP server that does not permit
> anonymous access and on which you have an account, e.g.
> ftp://host.domain.com/myfolder
>
> 3. Windows Explorer will prompt you for a username and password, and then
> will display the folder contents
>
> 4. Close Windows Explorer, then open Windows Explorer again.
>
> 5. In the Address bar, type ftp:
>
> At this point autocomplete should kick in and display the URI with at
> least your username and maybe the password displayed in clear text, e.g.
>
> ftp://username:password@host.domain.com/somefolder
>
> The version with the username and password don't appear in the Address
> bar's MRU dropdown, but just in prompts popped up by autocomplete. The
> password does not seem to appear in plaintext in the Registry.
>
> As I said, have one machine that reliably shows the password, and another
> that doesn't.
>
> Does anyone else find that the password is displayed?
>
> (No need to discuss the insecurity of FTP itself--that's not the issue
> here. This is about the potential for exposing previously used passwords
> on the desktop)
>
>
| 
XML site map