Third-party programs can make users’ lives easier by storing their credentials in them. This convenience often comes at the price of poor security, causing the risk of password theft. The article by Unit42 provides an overview of some common third-party programs that might contain credentials. It covers WinSCP, Git, RDCMan, OpenVPN and the Chromium and Firefox browsers, from WinSCP’s XOR-obfuscated registry value to Git’s plaintext credentials file. The vendors don’t hide it: WinSCP’s documentation states that saved passwords without a master password are “stored in a manner that they can easily be recovered”. Git’s git-credential-store manual likewise warns that the helper stores passwords “unencrypted on disk, protected only by filesystem permissions”. Reading the manual remains an underrated security control.
