Internet Explorer Passwords: How Secure Are They?

Password Saving in Internet Explorer: A Security Assessment

Modern web browsers provide a helpful feature: the capacity to store and automatically complete your passwords when you encounter login prompts. Given the prevalence of online accounts and the widely recognized risk of password reuse, a password manager – or a browser’s built-in equivalent – is becoming increasingly vital.

The Question of Security for IE Users

For individuals utilizing Internet Explorer, a key question arises: how secure is your password information if you consent to the browser's offer to remember it?

Allowing a browser to retain your credentials introduces potential vulnerabilities. The security of this stored data is dependent on the browser’s security mechanisms and the overall security posture of your computer.

Understanding the Risks

Several factors contribute to the potential risks associated with browser-saved passwords:

• Malware Infections: If your system is compromised by malware, attackers may be able to access stored passwords.
• Browser Vulnerabilities: Security flaws within the browser itself could be exploited to steal saved credentials.
• Lack of Encryption: Older versions of Internet Explorer utilized less robust encryption methods for storing passwords.
• Shared Computer Access: If others have access to your computer, they might potentially access your saved passwords.

It's crucial to understand that while browsers employ security measures, they are not foolproof. Relying solely on a browser’s password-saving feature may not provide the strongest level of protection.

Alternatives for Enhanced Security

To bolster your online security, consider these alternatives:

• Dedicated Password Managers: Utilize a reputable third-party password manager. These tools typically offer stronger encryption and additional security features.
• Strong, Unique Passwords: Create complex, unique passwords for each of your online accounts.
• Two-Factor Authentication: Enable two-factor authentication (2FA) whenever possible for an added layer of security.

Ultimately, a multi-faceted approach to password security is recommended. Combining strong passwords with a dedicated password manager and 2FA provides the most robust defense against unauthorized access.

Password Storage Locations

Beginning with Internet Explorer 7, passwords are maintained within the system registry. Specifically, they are located at the following key: KEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2.

These passwords aren't stored in plain text. Instead, they are encrypted using the Triple DES encryption algorithm.

Encryption Process

The encryption process leverages the Windows user's login credentials through the Data Protection API (DPAPI). This means the passwords are ciphered in relation to the user’s account password, adding a layer of security.

Essentially, access to the stored passwords requires both access to the registry location and knowledge of the user’s Windows login password.

Data Security Considerations

Currently, Triple DES encryption is considered exceptionally robust against attacks involving brute force techniques. However, the practical security relies heavily on the security of the underlying Windows account.

The system operates under the premise that once a user is authenticated into a Windows account, applications can safely access stored password data. This design introduces a vulnerability.

The Role of the Windows Account Password

Internet Explorer's lack of a master password feature – a security measure present in browsers like Firefox – means the Windows account password effectively serves as the decryption key for Triple DES-encrypted passwords.

Consequently, successful login to the Windows account grants access to all saved browser passwords. This is a critical point to understand.

Password Recovery Tools

Tools like NirSoft's IE PassView, readily available for free download, can be used to view and export all passwords saved within Internet Explorer.

This highlights the importance of strong Windows account security. Protecting the Windows account is paramount to safeguarding saved passwords.

• Triple DES: Remains highly secure against direct brute-force attacks.
• Windows Account: Its security directly impacts the safety of saved passwords.
• IE PassView: A utility that can reveal stored passwords.

In essence, the security of saved Internet Explorer passwords is inextricably linked to the security of the Windows user account. Maintaining a strong and unique Windows password is therefore essential.

Potential Malware Access to Stored Passwords

Given the relative ease with which this data can be accessed, a pertinent question arises: could malware readily obtain this information? While I lack expertise in malware development, there appears to be no inherent obstacle preventing such access.

A scan of the IE PassView utility using Virus Total reveals that 55% of the scanners employed identify it as malicious software, including Microsoft Security Essentials.