Solved

Is password hashed?

Posted on 2006-11-08
5
303 Views
Last Modified: 2013-12-04
If I have all access turned off on a virtual directory except Windows Integrated Security, and I programatiacally connect to the directory over the internet using vb.net (HTTPWEBREQUEST/RESPONSE methods),  will the password be hashed before it is sent over the network???  I know that typically it would be, but I am asking because I am doing this from a custom vb app. on a mobile device (running WinMobile5), not an ie browser on a pc.

It seems like it should get hashed somehow, but I'm wondering how it happens.  Does the OS handle the hashing, or do I need to add something to my app?
0
Comment
Question by:moreOncoding
  • 3
  • 2
5 Comments
 
LVL 24

Expert Comment

by:SunBow
ID: 17900470
Try it? I agree that "It seems like it should get hashed somehow", but there are reports of various insecurities built into the access  for mobile. More is better, if you can add something like another layer, where you have a footprint at both ends.
0
 
LVL 24

Expert Comment

by:SunBow
ID: 17900542
Researchers Criticize Security of Windows Mobile  
By  Matt Hines
October 26, 2006  
http://www.eweek.com/article2/0,1895,2040754,00.asp?kc=EWWMUEMNL110206EOAD


According to the latest report published by J. Gold Associates, a Northborough, Mass.-based wireless research firm, Microsoft's decision not to offer file encryption capabilities on its Windows Mobile platform reflects poorly on the technology compared to other popular wireless systems.

Unlike the push e-mail systems offered by rival mobile software makers including Good Technology, Research In Motion and Sybase, Microsoft's wireless messaging technology doesn't include data protection beyond simple passwords, researchers said.

The current versions of ActiveSync and AirSync only support specially formatted data sets that meet certain Microsoft data specifications, which means that any transfer of data from Exchange Server to Microsoft's Pocket Outlook must be done in an unencrypted file-state.

A new research report contends that by failing to offer onboard encryption for e-mail files stored on Windows Mobile devices, Microsoft may be putting itself at a competitive disadvantage and leaving users vulnerable to data loss.

Unlike the push e-mail systems offered by rival mobile software makers including Good Technology, Research In Motion and Sybase, Microsoft's wireless messaging technology doesn't include data protection beyond simple passwords, researchers said.
0
 
LVL 24

Accepted Solution

by:
SunBow earned 500 total points
ID: 17900584
For what the quote and remainder of article say - and do not say - I suggest you won't have to worry about their using clear text, the complaints are about encryption 'after' use of passwords.
0
 

Author Comment

by:moreOncoding
ID: 17906420
SunBow,

Regarding your first comment, how would I see if it were hashed or not?  I've run some tests and was able to connect, but had no way of seeing how the password was sent.  Is there some kind of log that I can look at?
0
 

Author Comment

by:moreOncoding
ID: 17979460
Since I've worked on this for some time without finding an answer, and since I do need to tell the people who gave me this assignment whether the password is hashed, I will increase to 500.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now