views:

32

answers:

1

Is there any way to extract credentials saved by TortoiseSVN?

+1  A: 

Based on the info below it sounds like you could possible decrypt them locally in some fashion...

UPDATE: Definitive answer from TortiseSVN community

When they're sent over the wire encrypted, they're encrypted using a handshake and/or agreed-upon key at the time of connection.

When they're stored/read locally, they're encrypted/decrypted via the Windows Crypto API which uses a key tied to your Windows account.

The locally-encrypted copy can't be decrypted by the server because the keys are local to your account.

So when you connect (let's say via HTTPS), your client gets the credentials decrypted via the appropriate Windows API, then includes them in the HTTPS transmission. HTTPS encrypts the whole communication between client & server using SSL certificates, not just the credentials.

Aaron
are you sure that the password is not decrypted at the client end?
Jus12
Pretty certain...without posting an explicit question to the TortiseSVN folks, here is what I found...http://tortoisesvn.net/docs/release/TortoiseSVN_en/tsvn-dug.html#tsvn-dug-general-auth In addition if it was decrypted client side, then pushed over in plain text to the server it would defeat the purpose. I guess you could send it over via SSH.
Aaron
but then effectively anyone could send the ciphertext to the server and tortoiseSVN does not provide any additional security by encryption.
Jus12
True which is why they make it known to delete the auth data from your PC on shutdown or at least in a periodic fashion if that is a concern. If the machine holding the auth data has been compromised then that is not really a TotoriseSVN issue per se.
Aaron
@Jus12 Polled the TortiseSVN community, check above...
Aaron
@Jus12, definitive answer from TortiseSVN community...see above...
Aaron
Thanks for the work. I was hoping there is already a tool for that.
Jus12