encrypting credentials is done plain wrong

Hey.

r21144 introduces some security measures that are intended to make credentials sniffing more difficult. That's snake oil. The key problem is that CString and other similar classes are totally unsuitable for storing sensitive data - see this http://stackoverflow.com/questions/3785582/how-to-write-a-password-safe-class and this http://stackoverflow.com/questions/3785366/how-to-ensure-that-compiler-optimizations-dont-introduce-a-security-risk for example, because they copy the string body in uncontrolled manner and don't overwrite the body once the string is no longer needed, so the program memory will be filled with gazillions of copies of a string before the program even knows.

My point is no encryption of program data makes any sense while unsuitable classes like CString are used for data manipulation. The first change should be replacing those classes with something that follows "use, then erase" strategy, then it'd make sense to use encryption. With current implementation the program stores one encrypted copy and an unknown number of unencrypted copies of the same string the program won't even think of.

Best wishes.
Dmitry.

------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=757&dsMessageId=2719366

To unsubscribe from this discussion, e-mail: [dev-unsubscribe_at_tortoisesvn.tigris.org].
Received on 2011-04-13 11:16:29 CEST