Memisyazici, Aras wrote:
whereby they take a hash of the password, with a non-std. hashing mechanism. The idea being that in today's world where there are so many scr1pt-kiddi3 toolz out there allowing the avg. Joe Schmoe the capability of analyzing one's memory processes i.e. Tsearch, memhack etc... It only makes it non-trivial for them to extract the info needed. This way you are making it a tad more annoying and adding another buffer they need to bypass :)
Okay, let's pretend you somehow prevent a local Administrator from reading the password out of memory... I'm already running code, so I install a key logger, and then crash/exit the process so you have to log in again. Once the attacker can run code on your system, it's game over. All you do by storing the password encoded is to make the attacker read the source to see how to decode it, and then write a k-rad 31337 script to automate it.