It's no surprise that users need password hints to remember the dozens of passwords they use in everyday life. Users have passwords for work computers, home computers, bank accounts, online forms and shopping carts, forums and social networks, and email. Most of these are used every day, but what about the passwords only used every month or every two months? To help users remember, Windows 7 and the future Windows 8 allows users to save password information on the local computer.
Windows 7 and 8 Store Password in the RegistryAlthough a password hint is considered harmless as long as the hint is difficult to guess, ars technica has released information on where the hints are stored on a Windows computer. The passwords are scrambled and stored in the Windows registry, which is a central location for all stored Windows preferences, security, and device driver locations. Although the hint is scrambled, hackers have uncovered the decryption scheme, so the hints can be read in plain text.
The hacker tool and process to decrypt the passwords were added to the Metasploit database, which is an open source sharing community for white hat and black hat users. This means that anyone with physical access to the computer and the ability to navigate around the registry can extract the hints. If a remote user has administrative rights on the computer, the Windows registry can be accessed as well. Remote access can be done over the Internet if a virus is present, or it can be done on a local business network through a LAN or public Wi-Fi.
What this means for midsize and small businesses is that any desktop is vulnerable to password hint extraction. While it doesn't mean the password is exposed, some users tend to use easy hints with easily guessed answers. For instance, if the hint indicates that the password is a family member, a person with enough information about the user can guess the password using the password hint.
Businesses are urged to ask users to keep password hints difficult and avoid using personal information that is commonly known. If the user has a hint with personal information, make sure the password uses a capital letter, a special character, and the password is at least eight characters long. If working on a public network, make sure the computer is protected from remote users using the Windows firewall.
