I'm trying to see how these commercial password managers seem to show their dialog window on what they claim to be a "Secure desktop". Here's one:

enter image description here

Then if you click its "Unlock on Secure Desktop" button it will show the password window on what appears to be another desktop:

enter image description here

And that desktop doesn't behave like a plain overlay. (I can run Task Manager over it but not much else.)

If I suspend the processes for this login dialog and then check them out from another Windows user account, the process that shows that password dialog doesn't seem to have any special privileges (marked with an arrow):

The logged in user at the time was Admin. DC is the second user that I'm using now to run Process Hacker with. I failed to make other instance of the Process Hacker (running under Admin) to show on that dark purple desktop with the password dialog.

enter image description here

And here is the token for the password dialog process:

enter image description here

So any idea how they're doing it?

  • This seems based on a misunderstanding of what a "secure desktop" secures against - essentially, the goal is to prevent 3rd party apps from operating each other (impersonating the user) and potentially to prevent them from impersonating system dialogs (password, etc) to capture information from a mislead user. The goal is not to prevent legitimate, clear interaction with the user. See security.stackexchange.com/questions/3759/… – Chris Stratton Mar 29 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.