PWL - Password List File
Get Informed


PWL - Password List File

When you log onto a network under Windows, you will usually see a dialog asking for your username and password. This dialog often also includes a check box offering to save your password for next time, so you do not need to enter it next time you log on.

You are advised not to do this, because it means that anyone who has access to your computer (even if it is switched off) will be able to access the network as if they were you. Windows already knows the password that it would normally ask you to supply when you restart the computer, so they will not need to enter it.

Also, for Windows to know your password, it must be stored somewhere on your computer. It cannot be encrypted, because then Windows would need to ask you to enter a password to access your password, which would defeat the object of the exercise. In fact, your password is stored in a PWL file using a scrambling algorithm that makes the actual password invisible to a casual observer.

But because Windows is able to unscramble the PWL file by itself, without any help from you, it follows that an attacker with a copy of your PWL file could unscramble the file, too. This is another reason why PWL files should be regarded as insecure, and you should avoid asking Windows to “remember” your passwords. It is well worth the inconvenience of being asked for your password each time you log on.

from Sophos' V-Files