Configuring a Host Directory Entry → Password Security

Password Security

Storing passwords in the host directory without a ZOC Master Password (see Program Settings → ZOC Password) does not provide strong protection against a determined attacker. Since ZOC is a publicly available software, someone with access to your host directory file may be able to reverse engineer the software, recover the embedded encryption key, and obtain the stored passwords.

We generally recommend using this feature without a Master Password only for hosts (e.g. test systems) where you consider the risk of unauthorized access to stored credentials acceptable.

Otherwise (without a Master Password), the security of the stored passwords will depend solely on your confidence in the fact, that nobody can access or copy your ZOC configuration folder, especially the file containing the host directory (HostDirectory.zhd).

Background: How stored passwords are protected

For hosts where you enter passwords to be stored in the host directory, when saving the host directory, for ZOC protects each password against casual observation (e.g., when someone views the file).

Without a Master Password, this mechanism is statically built into the application. However, someone who obtains a copy of your host directory file may be able to extract the mechanism from ZOC by reverse engineering the application and then use this knowledge to obtain the stored passwords.

Conclusion

If you need strong protection for your stored passwords, use a ZOC Master Password (see Program Settings → ZOC Password). Otherwise, avoid storing passwords in ZOC unless the associated hosts are of negligible importance.

Ultimately, you will need to weigh the following factors and balance them against each other according to your own needs and circumstances:

1. The convenience of using a ZOC Master Password
2. The convenience of storing host passwords
3. Your confidence in your ability to protect your ZOC configuration files
4. The risk of unauthorized access to the hosts whose passwords are stored in ZOC

 
← Back to Configuring a Host Directory Entry