I'm building an app for my school which enables the pupil to connect to the school's wifi network (wpa2). Into this app the password has to be hard coded because the technician doesn't want it revealed.I've seen some examples such as XNetwork, but I'd rather use Cocoa than AppleScript.
Can someone suggest how this can be accomplished via Cocoa?
Thanks!
The right way is not to make this an app at all, but to put the network password into a keychain which you put on the system image you apply to all of the machines. Then it will take considerably more effort to retrieve than a hard-coded password inside of an application, probably less effort to set up, and definitely less effort to enforce.
Make sure you put it into its own keychain. If you put it into the user's keychain, they'll be able to look it up using Keychain Access. If you put it into its own keychain, you can give that keychain a different password, and then students will be unable to examine the network password because they don't know the keychain password.
Related
I am having issues with the UI prompt which is asking me to enter my password to access the keychain credentials for proxy.
My mac is used in a local network without internet access, so I need to setup a proxy connection with username and password for browsing and all other mac services. I configured proxy including authentication in network settings. When browsing, chrome asks me once to enter credentials and it is working fine after then. If any other system service tries to connect, I am getting prompted to enter my password so proxy credentials can be fetched from keychain. I also changed the keychain entry to allow all applications to access it, but the prompt keeps on asking and asking and asking for my password. The next time, the keychain entry is changed back again to allow only some applications. Looks like it is always overriding the old entry.
Any ideas how I can fix that? Unfortunately I do not have any access on configuration of the proxy server or to change any parameters there, if it is a configuration issue of the proxy server. But there has to be a solution, I do not think entering the password hundreds of times a day can be an accepted solution.
My Mac is newly setup and running macOS Big Sur 11.2.1
Have you seen this answer https://apple.stackexchange.com/questions/106742/mac-username-password-for-proxy-settings-keep-resetting-by-itself? Usually you can move the password item in the keychain to the System section rather than the login section and this fixes the issue.
I have a similar issue but I am in a corporate environment and my issue seems to be related to NTLM https://apple.stackexchange.com/questions/292835/how-to-store-proxy-credentials-on-macos-so-they-are-used-by-system-services?rq=1
I have a question about windows authentication in other application like Google chrome.
I know about LDAP and I think my question should be something else.
Example: When I want to see my saved password in Google Chrome, it asked me my windows password.
1- How Google chrome is able to identify me? is it something available by windows, if yes that means I can use it even in any windows application.
(Considering this link Microsoft API should get the password and verify it but how can we use this API in our application?).
2- Is it secure from any kind of attack to password?
is there any one who can answer me in detail or give me the links?
Appreciate in advanced.
On Windows, this is CredUIPromptForWindowsCredentials. On Mac this is AuthorizationCopyRights. See src/chrome/browser/password_manager/‌password_manager_util_win.cc
This could conceivably be a vector for a program to phish the user's password if the user is unable to distinguish between a system credential prompt and an ordinary window. But the whole point of this is that your web browser is storing many website passwords, and rather leaving them exposed on disk they are protected at the OS level with the user's login credentials.
One way to see the effect of this is with the Mac build of Chromium (possibly Windows as well, but I have not tested), since the app is not codesigned. When you download a new version, you get a system prompt to confirm access to "Chromium Safe Storage". So not only is Chrome using its discretion to divulge stored passwords and reauthenticate the user, the operating system also makes a policy decision based on the app's signature.
Is there any more securely way to protect and store a password than Windows DPAPI do?
My program needs to store a secret (something like credentials) to do automatic logins on Windows, and this secret have to be shared with other users accounts because the program can be run on different accounts but sharing the credentials.
I need to protect this secret from tampering to avoid an attacker to inject his own credentials and take the control. If the attacker has phisical access I know that there is nothing we can do, but.... currently, what is the best way to store and protect this secret?
If you want to secure something against tampering, you are probably better off with a multi-level approach. The drawback to this is that gaining access (even with all secrets) is an astronomical feat and will bump up your login time on this.
Keep in mind, however, that a system is only as secure as its weakest point; you can have a file in a hidden encrypted volume behind even more layers of custom encryption, but if you have the passwords on a post-it note by your desk at work, odds are that it wont be secure for long.
The same applies with security on windows. ACLs and encryption are only as strong as your administrators' accounts. For tips on security, try Server Fault.
As for the system itself, implementing public-key cryptography (asymmetric encryption) through keys or digital certificates somehow and giving every user their own individual keys/IDs is a much safer alternative with far fewer risks.
Windows has supported pubkey infrastructure since at least windows server 2000; you can even use a smartcard logon if you have the hardware for it.
Consider the following:
1. An attacker obtains a private key (with protection on it) from a user. This can be broken #2048bit in an hour or two on average hardware. With this example, you need only remove the public key of the user and have them re-generate a new key.
2. An attacker obtains a user's digital certificate, then you have two options:
1) Remove their certificate from the Active Directory store, ACL or other certificate store.
2) Issue a revocation on the certificate, and forceably expire it. This assumes your are acting as the certificate authority.
In short, this answer states one thing: If you are worried about password security that much, then you should not be using passwords. If you make your system take forever to break, then the alternative route is a botnet bruteforce of a password.
Mozilla claims someone can sit at your computer and get your passwords for each site in 15 seconds. I learned while writing a Firefox extension for the first time that I could access any file in a users directory (given that it was owned by the user). If the passwords are decrypted and written somewhere in the users directory, then they are accessible during a session by a malicious extension or site that uses web code that may access a users directory. What is the process the Software Security Device uses in Firefox that ensures site passwords are really secure from such malicious code?
Decrypting passwords to the hard drive would be insecure because other processes could read them. Does the Software Security Device decrypt them to the users directory?
If not, then does the Software Security Device decrypt them only in ram? If so, then what are the possibilities of another application reading the application space of the Software Security Device?
Please describe.
Describing the process shouldn't be a secret, because secrets are an indication of vulnerability and weakness, instead a true secure method requires brute force to break. An open policy about the encryption process gives a wider audience, which increases the potential for more secure solutions.
I bring this up, because it's not described in the Software Security Device explanation or Master Password explanation on the Mozilla site, leaving me wondering if we are really secure using that feature.
The passwords are stored in the SQLite database signons.sqlite in user's profile directory. By default they are not really encrypted - extracting them from this file and "decrypting" is trivial. To have some security here the user has to define a master password (on the Security tab of the Firefox options), this one will be used to encrypt the passwords in the database. If that has been done then extracting passwords from signons.sqlite is non-trivial, one has to guess the master password.
But Firefox needs to decrypt the passwords to use them of course. If some browser code requests a password (via nsILoginManager) a master password prompt appears - the user needs to enter the master password to allow decrypting his passwords. The decrypted passwords are never written to disk but the browser (and any browser extensions) will be able to access them after that.
Firefox doesn't do anything to prevent extensions from accessing passwords because it would be pointless. The only way to prevent a malicious extension from getting to your passwords is to avoid installing a malicious extension in the first place. Even if nsILoginManager were not there, a malicious extension could still sniff on your communication with the web page when the password is transmitted. Or it could listen to what you type when asked for the master password. Or it could fake a master password dialog and get the master password directly. There are tons of possibilities - an application cannot possibly beat another application that is running with the same privileges.
PS: Software Security Device is for certificates, not passwords - entirely unrelated. But it uses the same master password, hence the confusing dialog.
What is the best way to send a password to a Windows Service? Our application needs a password in order to start. I don't care that services are "normally" supposed to run without user interaction. Its good enough for us that an operator can start the application and then log off.
On a unix system, I would just echo the password over stdin but the service has no stdin.
Currently, we use the DPAPI to just store the password using CryptProtectData. While this, works, it presents other problems that are beginning to become troublesome.
I'm guessing that I'll need to use some form of IPC between the service and the application that is sending the password but I'm not sure which method is appropriate, if any.
Thanks
Two main options:
You could listen on a socket on startup and wait for the required password to be supplied (maybe embed an SSH server in there, so that the password cannot be snooped over the wire)
My preferred option would be to read the password from a configuration file (that can be secured to the minimum readership) or registry setting (again, sufficiently secure such that only your service and administrators can read/change it)
Thanks for responding Rowland.
You could listen on a socket on
startup and wait for the required
password to be supplied (maybe embed
an SSH server in there, so that the
password cannot be snooped over the
wire)
I considered that but without certificate verification, wouldn't that leave us open to a man in the middle attack?
My preferred option would be to read
the password from a configuration file
(that can be secured to the minimum
readership) or registry setting
(again, sufficiently secure such that
only your service and administrators
can read/change it)
We're trying to follow "defense in depth" as much as possible such that if an attacker compromised the machine, he would not able to access our application.
You can use kerberos mutual authentication. There are few options and examples there.
But just wondering. On a compromised machine, There may be a key logger. So typing the password is never secure if you want to maintain security in this environment. The same problem exist afaik for unix terminals.
DPAPI in UserMode is really the best option, and storing the encrypted data in a protected location, e.g. registry key with limited ACL.
What exactly were the problems that are beginning to be troublesome? Maybe we can just solve those...
What exactly were the problems that
are beginning to be troublesome? Maybe
we can just solve those...
Currently, the application runs as the Local System account.
Our application stores a number of credentials in an encrypted file and uses the DPAPI (in UserMode) for the encryption.
Thus, when the application is installed, the installer is run as the Local System account. We also have a set of tools that ship with the application, some of which need access to this encrypted file and thus, they too need to run as the Local System account.
By the time the application is installed and started, we're heavily dependent on that account.
We're running into problems because one of our users wants to use the application to access a shared network drive. The Local System account has no such privileges and we can't simply run our service as a different user because our encrypted information is protected under the Local System Account.
We've tried to avoid the process of setting up a user account just for our application because it is installed across many different customers and environments, all of whom have wildly different security policies.
You can access a remote drive from a service running under system account. However, you will need to have credentials & share information to connect to the remote machine. You can use the API wnetaddconnection to gain access. Probably your encrypted file can store this credential as well.