Hacker News new | ask | show | jobs
by Dylan16807 698 days ago
> Makes me wonder how functions like CryptProtectData protect against physical disk access with hex editor. The hash of the login password can be changed to anything and obviously they cannot access the actual password since it should be destroyed after hashing. So unless TPM is involved I don't see how it can be secure.

It derives a key from your password when you log in. Changing the authentication hash will only let you log in, not figure out what the key was.

1 comments

Oh that's smart, not storing the password anywhere but using the user as an input source for it.