How to strengthen DPAPI encryption and password security?

201 Views Asked by At

We are using DPAPI method to protect password for our application using the below code. We checked and found that other users were able to decrypt the password if elevated privileges were gained.

Imports System.Text
Imports System.Reflection
Imports System.Security.Cryptography

Public Class Form1

    Private Sub Form1_Load(sender As System.Object, e As System.EventArgs) Handles MyBase.Load
        'Dim b As String = Protect("Password@123")
        'System.IO.File.AppendAllText("\\PC-NAME\D\1.txt", "start " & b & vbNewLine)
        'MsgBox(b)
        ' MsgBox(Unprotect(b))
        MsgBox(Unprotect("AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAApnUIqLR6vkqzZqDYfVAOrQAAAAACAAAAAAAQZgAAAAEAACAAAADM2Pzu5Z/KjrjQtBzfXXu1YChtK1CMJCP98vFcvRxshwAAAAAOgAAAAAIAACAAAAB7DFmhHkBTe2OaCUUo34ey469wTHulPoe9yCQzNlFR9BAAAADLF/JyBrVjvDA+h0N93GymQAAAAHA2uT7YL8W9KRCqQmdaNKHFJPUmIaG56ufOggvFrRwK5Owto6+6yRDrUUn76Ipj/v3tsgpr3YK66yNhMC+ahWE="))
        'System.IO.File.AppendAllText("\\PC-NAME\D\1.txt", "unprotected " & Unprotect(b) & vbNewLine)
    End Sub

    Public Shared Function Protect(ByVal str As String) As String

        Dim entropy As Byte() = Encoding.ASCII.GetBytes(Assembly.GetExecutingAssembly().FullName)
        Dim data As Byte() = Encoding.ASCII.GetBytes(str)
        Dim protectedDatas As String = Convert.ToBase64String(ProtectedData.Protect(data, entropy, DataProtectionScope.CurrentUser))
        Return protectedDatas
    End Function

    Public Shared Function Unprotect(ByVal str As String) As String
        Dim protectedDatab As Byte() = Convert.FromBase64String(str)
        Dim entropy As Byte() = Encoding.ASCII.GetBytes(Assembly.GetExecutingAssembly().FullName)
        Dim data As String = Encoding.ASCII.GetString(protectedData.Unprotect(protectedDatab, entropy, DataProtectionScope.CurrentUser))
        Return data
    End Function
End Class

If DPAPI is very secure, then how are the passwords able to be decrypted easily ? We would also like to know how applications like Skype which use DPAPI protects its users' passwords, as we were not able to decrypt them.

0

There are 0 best solutions below