I saw some code utilizing DPAPI. Given the research around MS’s poor DPAPI implementation, <http://elie.im/publi/recovering-windows-secrets-and-EFS- certificates-offline> , is it still safe to rely on DPAPI to protect my credentials? I am thinking not….
DPAPI
DPAPI still applicable?
I saw some code utilizing DPAPI. Given the research around MS's poor DPAPI implementation,
Key takeaways
- DPAPI protects secrets from users, but fails when the operating system identity is compromised.
- Cryptographic APIs are only as strong as their key derivation roots.
- Local credential caching remains an enterprise attacker's favorite highway.
About the author
Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.
