Problem - Kevin Tafuro

ters typed by the user. Instead, the password character will be displayed for each
character that is typed. By default, the password character is an asterisk (*), but you
can change it by sending the control an EM_SETPASSWORDCHAR message with wParam set
to the character to display.
Unfortunately, there is no way to prevent Windows from displaying something as
the user types. The closest that can be achieved is to set the password character to a
space, which will make it difficult for an onlooker to determine how many characters
have been typed.
To safely retrieve the password stored in the EDIT control’s internal buffer, the control
should first be queried to determine how many characters it holds. Allocate a
buffer to hold the data and query the data from the control. The control will make a
copy of the data but leave the original internal buffer unchanged.
To be safe, it’s a good idea to set the contents of the buffer to clear the password
from internal memory used by the EDIT control. Simply setting the control’s internal
buffer to an empty string is not sufficient. Instead, set a string that is the length of the
string retrieved, then set an empty string if you wish. For example:
#include
BOOL IsPasswordValid(HWND hwndPassword) {
BOOL bValid = FALSE;
DWORD dwTextLength;
LPTSTR lpText;
if (!(dwTextLength = (DWORD)SendMessage(hwndPassword, WM_GETTEXTLENGTH, 0, 0)))
return FALSE;
lpText = (LPTSTR)LocalAlloc(LMEM_FIXED, (dwTextLength + 1) * sizeof(TCHAR));
if (!lpText) return FALSE;
SendMessage(hwndPassword, WM_GETTEXT, dwTextLength + 1, (LPARAM)lpText);
/* Do something to validate the password */
while (dwTextLength--) *(lpText + dwTextLength) = ' ';
SendMessage(hwndPassword, WM_SETTEXT, 0, (LPARAM)lpText);
LocalFree(lpText);
return bValid;
}
Other processes running on the same machine can access the contents
of your edit control. Unfortunately, the best mitigation strategy, at this
time, is to get rid of the edit control as soon as possible.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Prompting for a Password | 397