Solved

Is password hashed?

Posted on 2006-11-08
5
307 Views
Last Modified: 2013-12-04
If I have all access turned off on a virtual directory except Windows Integrated Security, and I programatiacally connect to the directory over the internet using vb.net (HTTPWEBREQUEST/RESPONSE methods),  will the password be hashed before it is sent over the network???  I know that typically it would be, but I am asking because I am doing this from a custom vb app. on a mobile device (running WinMobile5), not an ie browser on a pc.

It seems like it should get hashed somehow, but I'm wondering how it happens.  Does the OS handle the hashing, or do I need to add something to my app?
0
Comment
Question by:moreOncoding
  • 3
  • 2
5 Comments
 
LVL 24

Expert Comment

by:SunBow
ID: 17900470
Try it? I agree that "It seems like it should get hashed somehow", but there are reports of various insecurities built into the access  for mobile. More is better, if you can add something like another layer, where you have a footprint at both ends.
0
 
LVL 24

Expert Comment

by:SunBow
ID: 17900542
Researchers Criticize Security of Windows Mobile  
By  Matt Hines
October 26, 2006  
http://www.eweek.com/article2/0,1895,2040754,00.asp?kc=EWWMUEMNL110206EOAD


According to the latest report published by J. Gold Associates, a Northborough, Mass.-based wireless research firm, Microsoft's decision not to offer file encryption capabilities on its Windows Mobile platform reflects poorly on the technology compared to other popular wireless systems.

Unlike the push e-mail systems offered by rival mobile software makers including Good Technology, Research In Motion and Sybase, Microsoft's wireless messaging technology doesn't include data protection beyond simple passwords, researchers said.

The current versions of ActiveSync and AirSync only support specially formatted data sets that meet certain Microsoft data specifications, which means that any transfer of data from Exchange Server to Microsoft's Pocket Outlook must be done in an unencrypted file-state.

A new research report contends that by failing to offer onboard encryption for e-mail files stored on Windows Mobile devices, Microsoft may be putting itself at a competitive disadvantage and leaving users vulnerable to data loss.

Unlike the push e-mail systems offered by rival mobile software makers including Good Technology, Research In Motion and Sybase, Microsoft's wireless messaging technology doesn't include data protection beyond simple passwords, researchers said.
0
 
LVL 24

Accepted Solution

by:
SunBow earned 500 total points
ID: 17900584
For what the quote and remainder of article say - and do not say - I suggest you won't have to worry about their using clear text, the complaints are about encryption 'after' use of passwords.
0
 

Author Comment

by:moreOncoding
ID: 17906420
SunBow,

Regarding your first comment, how would I see if it were hashed or not?  I've run some tests and was able to connect, but had no way of seeing how the password was sent.  Is there some kind of log that I can look at?
0
 

Author Comment

by:moreOncoding
ID: 17979460
Since I've worked on this for some time without finding an answer, and since I do need to tell the people who gave me this assignment whether the password is hashed, I will increase to 500.
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, a new law in my state forced us to get a top-to-bottom analysis of all of our contract client's networks. While we have documentation, it was spotty at best for some - and in any event it needed to be checked against reality. That was m…
Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question