Steve Syfuhs

Every once in a while you get a painfully bland view of the earth that turns into something wonderful once the image processors do their thing.

Google maps is a little more tame.

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

I think it was in the Win 10 era where we provided an ability to sync your credman database across machines. Incidentally, once upon a time, that used OneDrive to do the heavy lifting.

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

So anyway, we now have a way to protect your passwords by using your logon credential. When you log on you unlock the database and when the machine is off the key isn't on disk so grabbing the hard drive yields nothing. Actually that's not bad for the turn of the millenium.

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

And so we must make sure the database is accessible on first use and also protected from attackers walking off with hard drives, so what do? Aha! What if we use the users password they logged into the computer with?! Congratulations you've invented DPAPI: Data Protection API.

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

WELL what if we just prompt for a password to unprotect your passwords every time you need to use your passwords? You want to prompt for a ...password... to unlock your database of ...passwords... in lieu of a ...prompt... from a resource asking for said... password? Which, uh, password?

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

In Windows we have isolation promises. Kernel mode from user mode, user A from user B, etc. Therefore it's pretty straightforward that user B shouldn't be able to grab user A's passwords off the disk. We can do that through ACLs. But what if I'm an admin or I walk off with the hard drive?

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

Lets just rip the bandaid off: how the hell do you protect the long term storage of those passwords such that they're accessible when you need them and cannot be stolen? The answer to this question is the first step to destroying your soul: it depends; define 'stolen'.

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

That's fine, once, I guess, but what if you access this thing five times a day every day? It gets tedious. What if we put in a magical "Remember My Password" checkbox? Now you can connect those 25 times a week and never get prompted again. Obviously brillant!

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

And so we had an explosion of security stuff. It wasn't good, but it was transformational. And that security stuff meant logging in to...stuff. Passwords. Now in Windows world we had NT and soon Active Directory. A central place to orchestrate access to...stuff. One password to rule the world.

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

In typical Windows fashion it's more than that and all the gooey bits are hidden for simplicity. There are multiple dimensions to the Credential Manager. 1. How do we protect the credentials? 2. Who uses the credentials? 3. Can I roam the credentials? Hot topics today, but we had it in XP!

I suppose I should explain. Credential Manager, aka CredMan, aka cmdkey, is this thing.

The UI has existed for decades and it really hasn't gotten a whole lot of love over the years. The last major overhaul was in the Windows 8 era when we built out Integrity Level-aware WinRT APIs that lived on top of the underlying Cred APIs.