🚀 go-pugleaf

"JasperP" <Spam@SpamCop.net> wrote:

>I'm trying to create a small tool whereby users can retrieve their 
>passwords.
>So read a masked password from eg. Outlook.
>
>How can I manage this?

I rather hope you can't - because if you can, it means that there really
is no security in Windows.

(And I'm naive enough to hope that there's enough to defeat this, at
least.)

In principle, you should be able to use GetWindowText() using the window
handle. This can, in principle, be used to go cross-process. On the
other hand, it's down to control receiving the WM_GETTEXT message to
disable the functionality, and I would rather hope that a password entry
field does so.

If it didn't, then it's too easy for a virus on your machine to grab all
your passwords and email them to Lithuania, or Miami, or wherever.

An alternate solution - and no, I've not even thought about trying this
- would be to watch for new windows appearing with the ES_PASSWORD
attribute. When one does, you could pop up your window instead for the
user to type into, and then send the result off to the original.

(I assume that WM_SETTEXT would still work.)

Alan Bellingham
-- 
ACCU Conference: 11-14 April 2007 - Paramount Oxford Hotel