IE AutoComplete Encryption

[A5k]

Hi all,
I've posted this thread in the Microsoft: Internet Explorer forum on Monday (the 15th) and no replies, so I figured I'd try my hand at a forum that deals *with* security and not how to enable/disable it . Anyways, here we go...

We all know and have read many articles saying that AutoComplete should be disabled since a malicious user can gain sensitive data from this 'feature'. However all the documentation on AutoComplete states that the information is encrypted. Does anyone know what encryption scheme MS uses for AutoComplete? I would assume they would use at least 128-bit but then again what do I know...

-a5k

 

[Guest_imported]

They almost certainly use CryptProtectData, where the windows login is part of the key. See

http://msdn.microsoft.com/library/d.../en-us/security/Security/cryptprotectdata.asp