Re:DPAPI security flaw in Windows 10
by icebraining on Tuesday June 18, 2019 @02:52AM
(#20210304)
You don't need to be an admin, just have physical access and plug the drive into another computer. Which is why the early W10 versions used to require enabled full-disk encryption before allowing this feature.
[ Parent
| on HN ]
I am not sure what you mean.
If the drive is not encrypted, then anybody can read any data. <- OK, that is incorrect. DPAPI is supposed to protect from this by deriving encryption key from your password.
If the drive is encrypted you'd have to know the drive encryption key, which likely (if not necessary) means you are the administrator.
Re:DPAPI security flaw in Windows 10
by icebraining on Tuesday June 18, 2019 @03:04AM
(#20210347)
> OK, that is incorrect. DPAPI is supposed to protect from this by deriving encryption key from your password.
That's the point: DPAPI is (deliberately) bypassed by TBAL, by storing the necessary info from the user's password to decrypt the DPAPI key after reboot.