Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Keychain on Windows? #9946

Closed
cyberduck opened this issue May 18, 2017 · 4 comments
Closed

Keychain on Windows? #9946

cyberduck opened this issue May 18, 2017 · 4 comments
Labels
enhancement interface User Interface worksforme

Comments

@cyberduck
Copy link
Collaborator

65d59a4 created the issue

I noticed the option to save credentials in keychain. I guess that's for Mac only or would it also utilize the Windows vault?

Where is password/authentication information stored in Windows? What happens when someone hacks into a Windows account by resetting a users' password? And finally, if that keychain option is just for Mac, why is it displayed at all in the Windows version?
@cyberduck
Copy link
Collaborator Author

@dkocher commented

On Windows, passwords are encrypted using the Windows Data Protection API (​DPAPI) and stored in the user.config file in the ​application support directory.

https://trac.cyberduck.io/wiki/help/en/howto/connection#GeneralConnectionUseKeychain

@cyberduck
Copy link
Collaborator Author

65d59a4 commented

Thanks for the reply. So if the keychain setting in preferences isn't applicable to Windows, I'd suggest not showing it in the Windows version as it serves no purpose. It's just confusing.

@cyberduck
Copy link
Collaborator Author

65d59a4 commented

So I was also testing Google Drive and Cryptomator integration and observed the following:

  1. Create bookmark for Google Drive
  2. Access Cryptomator Vault in Google Drive by entering (and saving) master password.
  3. All works fine.
  4. Delete bookmark and history item.
  5. Close Cyberduck.
  6. Recreate Google Drive bookmark from scratch.
  7. Voila, it gives access to the Cryptomator vault without requiring the password again.

Strange. Where was the password saved in the meantime? Shouldn't it be deleted from the system when a bookmark is deleted?

@cyberduck
Copy link
Collaborator Author

@dkocher commented

If you choose Save Password, the password for the vault is stored encrypted using the Windows Data Protection API in user.config on Windows and can be reused on later attempts to open the encrypted vault regardless of the bookmark used to connect.

@iterate-ch iterate-ch locked as resolved and limited conversation to collaborators Nov 26, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
enhancement interface User Interface worksforme
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@cyberduck