News for hackers. Stuff that matters.

A comment on DPAPI security flaw in Windows 10. Parent comment

Re:DPAPI security flaw in Windows 10 by lostmsu on Tuesday June 18, 2019 @02:56AM (#20210316)
I am not sure what you mean.

If the drive is not encrypted, then anybody can read any data. <- OK, that is incorrect. DPAPI is supposed to protect from this by deriving encryption key from your password.

If the drive is encrypted you'd have to know the drive encryption key, which likely (if not necessary) means you are the administrator.

[ Parent | on HN ]
Re:DPAPI security flaw in Windows 10 by icebraining on Tuesday June 18, 2019 @03:04AM (#20210347)
> OK, that is incorrect. DPAPI is supposed to protect from this by deriving encryption key from your password.

That's the point: DPAPI is (deliberately) bypassed by TBAL, by storing the necessary info from the user's password to decrypt the DPAPI key after reboot.

[ Parent | on HN ]