Pageant appears to remember smartcard PINs across reboots

NoMoreFood / putty-cac

Windows Secure Shell Client With Support For Smart Cards, Certificates, & FIDO Keys

474 stars 43 forks source link

Pageant appears to remember smartcard PINs across reboots #134

Closed minfrin closed 2 months ago

minfrin commented 2 months ago

After configuring pageant against a smartcard via CAPI, scp works.

Rebooting the machine, logging in and running pageant, scp works again, without asking the end user for the PIN to unlock the smartcard. This suggests the end user's PIN is being stored somewhere on the machine, compromising the PIN to anyone with access to the machine.

Can this behaviour be confirmed?

NoMoreFood commented 2 months ago

If this is occurring, it's definitely not in PuTTY CAC. It might be a "feature" of the specific smartcard minidriver you are using.