Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
After analyzing a number of laptops equipped with UPEK fingerprint readers and running UPEK Protector Suite, we found that your Windows account passwords are stored in Windows registry almost in plain text, barely scrambled but not encrypted. Having physical access to a laptop running UPEK Protector Suite, we could extract passwords to all user accounts with fingerprint-enabled logon. Putting things into perspective: Windows itself never stores account passwords unless you enable “automatic login”, which is discouraged by Microsoft.
However UPEK's maker disputes these allegations:
Authentec, which makes the widely used UPEK fingerprint scanner, said on Wednesday that it couldn't find any evidence to support the allegation that its software stores Windows passwords insecurely, exposing customers to potential hacking.
An attacker who is able to recover a Windows account password can access anything the user is able to, including files encrypted with Windows' built-in EFS file encryption, and other credentials protected by the user's password.
Back to top
