...
Applications such as password managers may need to retrieve the original password to enter it into a third-party application. This is permitted even though it violates this guideline. The password manager is accessed by a single user and always has the user's permission to store his or her passwords and to display those passwords on command. Consequently, the limiting factor to safety and security is the user's competence rather than the program's operation.
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.MSC62.PCCF CERT.MSC62.PWDPROP CERT.MSC62.PWDXML CERT.MSC62.WCPWD CERT.MSC62.WPWD CERT.MSC62.PLAIN CERT.MSC62.PTPT CERT.MSC62.UTAX | Avoid storing usernames and passwords in plain text in Castor 'jdo-conf.xml' files Ensure that passwords are not stored as plaintext and are sufficiently long Ensure that passwords are not stored as plaintext and are sufficiently long Avoid unencrypted passwords in WebSphere 'ibm-webservicesclient-ext.xmi' files Avoid unencrypted passwords in WebSphere 'ibm-webservices-ext.xmi' files Password information should not be included in properties file in plaintext Avoid using plain text passwords in Axis 'wsdd' files Avoid using plain text passwords in Axis2 configuration files |
Bibliography
| [API 2013] | |
| [Hirondelle 2013] | Passwords Never Clear in Text |
| [OWASP 2012] | "Why Add Salt?" |
| [Paar 2010] | Chapter 11, "Hash Functions" |
| OWASP ASVS | |
| [NIST 2017] | NIST 800-63 |
...