How does Windows cache passwords?

[paulwood]

This question comes from another thread615-127419 discussing the function of the pwl file. I know it's for user passwords, etc but is it used by IE for instance to cache internet passwords? If it is, how are passwords cached if there is no pwl file, is there another file used? I know some stuff is put in the registry by ftp programs, etc does this apply to IE?

Feel free to add your 2 penny-worth

 

[reghakr]

Paul,

There is some info here:

http://www.iopus.com/wasp.htm

My experience has been that it's used only as the Windows logon password 98% of the time

I used to have a dial-up connection to Sprynet. This was saved in the standard Windows password file. But remember, this was yeqars ago. I don't think many do it any more. As WASP states:

Please note that this listing will contain (only) the stored passwords of the currently logged on user (= you!). Furthermore it can of course only contain the passwords that are actually stored in the PWL file. Since the PWL file is a Microsoft invention, these are largely passwords used by Microsoft products. For example, your dial-up password(s) or passwords stored by Internet Explorer are located in this file.

Other passwords that may end up here are those that generate the Windows dialog box requesting username and password, such as access to a members only site.

Truthfully, when people have problems with the Windows login box appearring or not appearring, my answer is always delete the *.pwl files in the c:\windows directory. I have never heard anyone comment that they have lost passwords or any type of other ill affects. I have received many a thank you for the answer.

My 2 pennys-worth.

reghakr

 

[paulwood]

Reg,

Thanks for the link, I downloaded the software, and it shows the same as pwltool. The pwl file includes url's, usernames and passwords for secure areas of some sites I subscribe to, along with all the DUN passwords and usernames, and access passwords and usernames for some of my clients' sites. The list is by no means complete however, so for the other sites, there must be a cookie.

I guess I should clarify the use of the word 'lose' in relation to deletion of pwl files. What I meant was that for passwords that are cached in this file, the passwords would have to be entered again once the file was deleted. Sometimes it's better to use all the words you need, than try 'shorthand'

 

[reghakr]

Then in your case I can understand why you were a little concerned.

The only ones I know that are held in the registry are the auto-complete passwords.

reghakr