Security Related Notes → Remembering Passwords

When using the feature to remember passwords, we strongly recommend that you also set a ZOC Master Password.

The reason for that is, that using this feature to remember passwords/passphrases without a ZOC master password (see Program Settings → Master Password) may not provide a strong protection against a determined attacker.

Background

Your remembered passwords are stored in the Windows registry or macOS keychain. Without a master password, the remembered passwwords are stored using a mechanism is statically built into the application. However, someone who gains access to the Windows registry or macOS keychain may be able to extract the mechanism from ZOC by reverse engineering the application and then use this knowledge to obtain the stored passwords.

If you do user a master password, the enryption mechanism will derive the encryption key from your master password, which will make breaking the encryption orders of magnitude harder.

Conclusion

Ultimately it is your decision how or if you use this feature. But you will need to weigh the following factors and balance them against each other according to your own needs and circumstances:

1. The convenience of using a ZOC Master Password
2. The convenience of storing host passwords
3. Your confidence in your ability to protect your ZOC configuration files
4. The risk of unauthorized access to the hosts whose passwords are stored in ZOC

Note: System administrators can disable this feature in ZOC's admin.ini file.

 
← Back to Security Related Notes