How do "password crackers under asterisks" work?

Question

Passwords

Probably a stupid question, but it became interesting - how do programs that reveal passwords hidden under asterisks in Windows applications work? And how to protect the password from such programs?

Answer 1

If we are talking about a standard Windows control, then everything is quite simple.
Such an input field is a regular single-line input field with the ES_PASSWORD window style set.
In order for such an input field to show the password text instead of asterisks, it is enough to send it the message EM_SETPASSWORDCHAR with wParam = 0 Related
article in MSDN
Protect - for example, instead of before of the entered password, display abstract text prompting you to enter a new password. In other words, do not tell the control the previously entered password.
Starting with some WinXP service pack, this is done in remote access dialogs, for example.

Answer 2

In my opinion, even asterisks should not be displayed, if you really act “wisely”. Because by roughly estimating how many stars a person standing behind can pull out a hard one and set a more-correct rule for selection in a brute-forcer program. UNIX-like systems have the best solution by default, they do not escape either the password or the asterisks.

Answer 3

In order to be 100% protected from such programs, it is enough to implement the “password input field” element yourself.

Answer 4

Hm. That is, we manually process the text change events in the field, encode and take the resulting text somewhere into an internal variable, and write something like “a password was entered here” into the text property, right?