[mecury_2001]

password is kept in pwl folder

[WhitPhil]

Originally Posted by mecury_2001

password is kept in pwl folder

Well, not really!

[mecury_2001]

Originally Posted by WhitPhil

Well, not really!

okay, but i really did not want to go into details

[WhitPhil]

Win 9x used PWL files. XP doesn't.

[mecury_2001]

Originally Posted by WhitPhil

Win 9x used PWL files. XP doesn't.

once again in my haste i failed to read the os

[JohnWill]

Passwords are encrypted in the registry.

[neos1]

Originally Posted by WhitPhil

What did you encrypt them with?
And, I don't think the password is kept in the pagefile, since it is perfectly legit to delete and have the pagefile re-created. Thus, if the password were there, all would be lost.

It is most likely kept (in encrypted form) in the registry. Which is also where Roboform most likely keeps it's entries.

TrueCrypt.

So you are saying that XP knows what is and what is not my banking password and encrypts it?
I guess I'm not sure now that I understand what the page file actually is. I thought that when the ram is full some if not all of what is in the ram is dumped into the page file.
So if I'm filling in a form with my credit card number; it will never be found in the page file?

[JohnWill]

Passwords are not left in memory in clear text, so if they get paged out, they're not in clear text there either.

[neos1]

Thanks for clearing that up for me JohnWill.

[neos1]

Originally Posted by WhitPhil

What did you encrypt them with?
And, I don't think the password is kept in the pagefile, since it is perfectly legit to delete and have the pagefile re-created. Thus, if the password were there, all would be lost.

It is most likely kept (in encrypted form) in the registry. Which is also where Roboform most likely keeps it's entries.

\

I use TrueCrypt.

[WhitPhil]

I'm not sure where TrueCyrpt maintains it's settings, but would lay money that it is registry based and absolutely guaranteed that they are not in the pagefile.

[neos1]

Originally Posted by WhitPhil

I'm not sure where TrueCyrpt maintains it's settings, but would lay money that it is registry based and absolutely guaranteed that they are not in the pagefile.

This is not to say that True Crypt doesn't keep it in the registry. And there is no real reason for me to encrypt anything
except passwords which are 9+ characters (Aa~1) in word doc because
I cannot keep track of them in my head and worst practice is to write them down.
Best practice from what I understand is to change password/phrases every so often.

My take on the subject of encryption and incorporating it into my security habits is something akin to buckling my seat belt. I'll probably only need it once, but which once?

[JohnWill]

Where in that clip does it say that passwords are maintained in memory or in the paging file in clear text?

[neos1]

Originally Posted by JohnWill

Where in that clip does it say that passwords are maintained in memory or in the paging file in clear text?

It does not say that. It does say that if a sensitive document is brought out of an encrypted state and placed into RAM, then it is possible that the doc can be dumped into the page file
unencrypted . As stated earlier in this thread, it would take a forensics expert to read what was in the page file and the folks at True Crypt are probably writing this to someone who either has State's secrets to protect or think they have.

[JohnWill]

Anyone who's that worried about what's in their pagefile needs to reexamine what they're doing with their time and computer.