Re: SecureFile

-----BEGIN PGP SIGNED MESSAGE-----

> Querisoft's SecureFile v1.0 Beta for Windows NT and Windows 95 (with IE
> 3.x) is now available
> for download from http://www.querisoft.com/securefile.html. This is one
> of the first client
> applications that uses Microsoft's CAPI 2.0 (beta)

Umm... reading your faq... (http://www.querisoft.com/SFFAQ.html) you
state that you use the windows95 user password as the password for
encrypting files. You also seem to imply that you don't actually
_ask_ for the password, windows gives it to you (albeit hashed
or something already, I imagine). If that is the case, that is extremely
worrisome. In fact it's outrageous.

That would imply that any _other_ application, benign or evil, could
also 
access the same password and immediately decrypt files.

Is that so? (Not coding much on windows, I don't know if applications
can access the user's hashed or encrypted password, but I would guess
they could.)

Jeremey.

- -- 
=-----------------------------------------------------------------------= 
Jeremey Barrett                                  VeriWeb Internet Corp.
Crypto, Ecash, Commerce Systems                  http://www.veriweb.com/

PGP Key fingerprint =  3B 42 1E D4 4B 17 0D 80  DC 59 6F 59 04 C3 83 64
=-----------------------------------------------------------------------=

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMyA7YS/fy+vkqMxNAQGVSAP/dc1ZwWdfdJZ8gfJNUY3tias5LZi3pWzf
NihyMClArDG7Nb+XQ+s+EILi+FCMCJgtnxoc5AYGW/M/2YlHq9P0ZsUG/PQCgP9x
3+rHi8Zl2BIEqhbkKh0RfAo1Ag6/gSygpTKJz+jQCb440FpTT1CpFCKyN5HSNczc
ZuJwhM4Fzi4=
=ao2E
-----END PGP SIGNATURE-----

Jeremey Barrett wrote:
> Umm... reading your faq... (http://www.querisoft.com/SFFAQ.html) you
> state that you use the windows95 user password as the password for

> encrypting files. You also seem to imply that you don't actually
> _ask_ for the password, windows gives it to you (albeit hashed
> or something already, I imagine). If that is the case, that is extremely
> worrisome. In fact it's outrageous.

 
> That would imply that any _other_ application, benign or evil, could
> also
> access the same password and immediately decrypt files.
> 
> Is that so? (Not coding much on windows, I don't know if applications
> can access the user's hashed or encrypted password, but I would guess
> they could.)

SecureFile is not using the Win 95 password for encrypting the files.
Win 95 or Win NT never hands over the password to any application.

CAPI 2.0 is so nicely integrated with the OS that unless you have logged
in you wont get access to you keys. Now SecureFile is CAPI 2.0 based
application, so to use SecureFile you have to log in. Once this is done
the crypto operations (encryption/signing) etc are performed using your
keys.

The advantage you gain is that, a separate SecureFile logon is not
required and nobody but you will be able to access your keys as they are
protected by the OS.

The SecureFile setup ensures that on Win 95 you have actually logged in
and that you are working in the "Multiple Profiles" mode.

Thank you for your interest in SecureFile. Please feel free to ask any
questions you may have.

Anand Abhyankar
SecureFile Team
Querisoft Systems Pvt. Ltd.

-----BEGIN PGP SIGNED MESSAGE-----

Anand Abhyankar wrote:
> 
> SecureFile is not using the Win 95 password for encrypting the files.
> Win 95 or Win NT never hands over the password to any application.

Good.

> 
> CAPI 2.0 is so nicely integrated with the OS that unless you have logged
> in you wont get access to you keys. Now SecureFile is CAPI 2.0 based
> application, so to use SecureFile you have to log in. Once this is done
> the crypto operations (encryption/signing) etc are performed using your
> keys.
> 
> The advantage you gain is that, a separate SecureFile logon is not
> required and nobody but you will be able to access your keys as they are
> protected by the OS.

Out of curiosity, do you know how the keys are protected by windoze
itself?
I have the CAPI cd but have had all of 5 minutes to look at it.  I would 
presume they're hashing your password into a key and then encrypting
with 
it, or encrypting another key with it. Any idea?

What is somewhat bothersome (and this would go for anything using CAPI
in the way your product does) is the reliance upon the windoze password.
If that were compromised, it seems all other CAPI integrated keys would
also be compromised. Let's hope they choose good passwords, and know not
to re-use the same one on the net somewhere. :-)
(BTW, does windoze allow arbitrary length passwords or phrases, or does
it
have a short limit?)

Jeremey.

- -- 
=-----------------------------------------------------------------------= 
Jeremey Barrett                                  VeriWeb Internet Corp.
Crypto, Ecash, Commerce Systems                  http://www.veriweb.com/

PGP Key fingerprint =  3B 42 1E D4 4B 17 0D 80  DC 59 6F 59 04 C3 83 64
=-----------------------------------------------------------------------=

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMyKP5y/fy+vkqMxNAQHayQQAlQ1URquOTf0LNqX4Gsw340KRNsz+e4hk
hJDaw61vNzWV7oCQtZeTYrpWYnf9nuZ0r3qaTGHE8b+s3whAEz7iXtS/DzNXz3dQ
0fce/EW9oMHjZa9xiilPb4FMbRMJJFShJ2WUSP/ZuMkaKXVftu5UG5I/FHxhpt+g
A4sqBEOangQ=
=PLfS
-----END PGP SIGNATURE-----

Jeremey Barrett wrote:
> Out of curiosity, do you know how the keys are protected by windoze
> itself?

I am sorry I dont understand you question.

> I have the CAPI cd but have had all of 5 minutes to look at it.  I would
> presume they're hashing your password into a key and then encrypting
> with
> it, or encrypting another key with it. Any idea?

Your Windows password is not used to actually any data. The Windows
login just lets you access your keys. This way even if you change your
Windows password it will not affect yout CAPI installation. As long as
the OS identifies you it lets you access your keys.

> What is somewhat bothersome (and this would go for anything using CAPI
> in the way your product does) is the reliance upon the windoze password.
> If that were compromised, it seems all other CAPI integrated keys would
> also be compromised. Let's hope they choose good passwords, and know not
> to re-use the same one on the net somewhere. :-)

Yes! you are right. Security without a good policy is an open door.

> (BTW, does windoze allow arbitrary length passwords or phrases, or does
> it
> have a short limit?)
> 

This can be configured by the administrator of the domain.

> Jeremey.

Thank you for your interest in SecureFile. Please feel free to ask any
questions you may have.

Anand Abhyankar
-- 
                                             \|||/
                                            ( O-O )
 *----------------*-----------*--------.ooo0--(_)-0ooo.----------*
  Anand Abhyankar                                               
  Querisoft Systems Pvt. Ltd.   Email       : anand@querisoft.com 
  810, Sindh Society, Aundh,    Phone (Off) : 91-212-385925       
  Pune - 411 007. INDIA               (Res) : 91-212-351023
                                          .oooO         
                			  (   )   Oooo.
 *----------------*-----------*------------\ (----(   )----------*
                                            \_)    ) /
                                                  (_/