Windows doesn't have a system level key store. Instead the Windows API's have a ... | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

balls187 on Aug 3, 2021 | parent | context | favorite | on: Malicious PyPI packages stealing credit cards and ...

Windows doesn't have a system level key store.

Instead the Windows API's have a symmetric encryption API (DPAPI) that allows developers to supply plain text, and receive cipher text.

It would then be up to developers to persist the cipher text.

DPAPI master key is protected by the OS, behind User Credentials.

blibble on Aug 3, 2021 [–]

isn't it per user though, instead of per developer (like apple)?

a dodgy pypi package that can call CryptUnprotectData too

balls187 on Aug 4, 2021 | [–]

Per login credential, yes.

blibble on Aug 4, 2021 | | [–]

so that's essentially useless against this sort of attack?

Consider applying for YC's Spring batch! Applications are open till Feb 11.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact