Search  Rules  Login
TheBat English » The Bat! - Configuring the E-mail Client
Pages: 1
RSS
Is the Bat safe?
 
#1
0  
I used a few "password recovery" software to test security weaknesses of my software. Almost all of pass recovery programs showed me my email passwords on the Bat.
 
 
 
#2
0  
1.
"password recovery"...
You can use OTFE-mode. (storing crypted data).
Here is no chance to decript password with "password recovery software".

2.
Also you can use secure connection (if mail-server support it).
 
 
 
#3
0  
I guess wadpro means the passwords for mail accounts (acc. properties -> transport) - almost any **** password revealing tool will disclose them instantly (whether OTFE is used or not doesn't matter in this case). Check for example Revelation from www.snadboy.com

This is a very serious security issue.
My Bat stays opened all the time, because I have some scheduled tasks (and the built-in scheduler only works if TB is opened). So anyone having a physical access to the machine may get all my passwords in less than a minute.
BTW this should be very easy to fix, I guess what has to be done is simply to remove the password boxes and replace them with a 'Set password' button.  
 
 
 
#4
0  
No I dont mention only showing asresiks. You can do that of course but you can also see mail passwords on bat without opening the bat.
 
 
 
#5
0  
wow .. holly $h!t
it's really available in plain text! So things are far worse than I thought so far. If one does not use OTFE (and surely not everyone wants that), there is practically no security at all. Having a password stored as plain text is next to having a sticky note with it on your monitor.
Unbelievable!!
And even if OTFE is used, this does not stop elementary password revealers.
 
 
 
#6
0  
If you dont believe me, i can tell you which programs I used. Test it yourself.
 
 
 
#7
0  
I do believe you because in the first account.something file I opened in Notepad I saw my smtp password for that account as plain text.
And a google search for 'thebat password recovery' brings 500 000+ results - I didn't tested any, but as they say there's no smoke without fire  
 
 
 
#8
0  
account setting is stored in binary file ACCOUNT.CFN and both login and passw are encrypted and not stored in plaintext.
 
 
 
#9
0  
but there are some (i know about 4) apps able to decrypt this, so in case You need higher security because somebody have access to your computer, You can use OTFE. In OTFE mode, DES algorithm with 128bit key is used and data on HDD are not decrypted by The Bat! when You open it.
 
 
 
#10
0  
Quote
Marek Mikus wrote:
account setting is stored in binary file ACCOUNT.CFN and both login and passw are encrypted and not stored in plaintext.

I have accounts for which username/pass for POP and SMTP are different (I just use a common SMTP for all accounts). In the ACCOUNT.CFN , SMTP password is stored in plain text. Needles to say, this password is also valid for POP on the same server.
Pop password is not stored in plain text, but if one starts to experiment with one letter passwords, I guess the obfuscation mechanism will be easily revealed. As there are apps that can get the password, obviously it's not encrypted using some serious and proven algorithm but just obfuscated.

I know OTFE is far more secure, but have reasons not to use it (and if I correctly remember, it does not exist at all in the home version). Message base may be unencrypted without OTFE, but login information must be strongly encrypted in any case!
And even if OTFE is used, it does not provide protection against **** password revealers.
So, IMHO theBat is NOT safe. It is very far from safe, and users should be aware of this. Otherwise it's no doubt the best mail client ever.  
 
 
 
#11
0  
Thank you for pointing that out! In earlier versions of The Bat!, e.g. 1.62, account passwords were encoded in a form of Base64-encoding in the account configuration file. This encoding is not an encryption, it is simply means of avoiding storing them in plaintext easily readable form. In later versions, the passwords were not encoded in the configuration file, because we’ve implemented the OTFE encryption to protect the configuration data. Encoding the passwords may give the false sense of security, thus we didn’t encode them. However, we may encode them in future versions using the same algorithm as in earlier versions of The Bat!
OTFE does only protect the data on the disk, not in the computer’s memory. For example, if somebody physically steals the storage media while the computer is turned off, it would not be reasonable to get the original data, e.g. account password, due to computational difficulties of decrypting an RC2 128-bit chipher without knowing the key.
However, when the legitimate user have started The Bat! With OTFE encryption, the “asterisk” issue would not help anyway, since the configuration data has been loaded into the computer memory and can be read by a malicious software.
To resolve the issue of POP3/SMTP password leaks, we recommend using hardware CRAM-MD5 authentication. You can read more about hardware authentication at http://www.ritlabs.com/en/products/securebat/authentication.php
 
 
 
#12
0  
I would advise [if your SMTP server permits] to use the passwords on a token along with the RFC2095 (MD-5 CRAM-HMAC) authentication.
winXP-SP3 Pro, the Bat! v4.0.38
 
 
 
Pages: 1