Implement password-protected TextBox that are really secure

Implement password-protected TextBox that are really secure

As explained in another tip in this TipBank, users can peek at the contents of password-protected TextBox controls with a simple Spy-like program, or even with a VB program plus some API functions. The problem is that such TextBox controls react to the WM_GETTEXT message and the GetWindowText API function as if they were regular TextBox controls. This holds True under Windows 95, 98 and NT. (Windows 2000 has fixed this security issue.)

If you want to make sure that no one can steal passwords from your VB programs, you only have to subclass the WM_GETTEXT message and discard the call. The following code snippet relies on the MsgHook.Dll (that you can download from the FileBank section of this site).

' ASSUMES THAT YOU HAVE ADDED A REFERENCE TO THE MSGHOOK.DLL'Dim WithEvents TextHook As MsgHookPrivate Sub Form_Load()    Set TextHook = New MsgHook    ' Text1 is the password-protected control    TextHook.StartSubclass Text1End SubPrivate Sub TextHook_BeforeMessage(uMsg As Long, wParam As Long, lParam As Long, _    retValue As Long, Cancel As Boolean)    ' filter out the WM_GETTEXT message        If uMsg = WM_GETTEXT Then Cancel = TrueEnd Sub

If you discard the WM_GETTEXT message, no application will be able to read the contents of your control.

It is remarkable that this subclassing code doesn’t prevent the current application from reading the contents of the password-protected control. The reason is – evidently – that VB doesn’t rely on API calls to read the Text property of a TextBox.

Share the Post:
Heading photo, Metadata.

What is Metadata?

What is metadata? Well, It’s an odd concept to wrap your head around. Metadata is essentially the secondary layer of data that tracks details about the “regular” data. The regular

XDR solutions

The Benefits of Using XDR Solutions

Cybercriminals constantly adapt their strategies, developing newer, more powerful, and intelligent ways to attack your network. Since security professionals must innovate as well, more conventional endpoint detection solutions have evolved

AI is revolutionizing fraud detection

How AI is Revolutionizing Fraud Detection

Artificial intelligence – commonly known as AI – means a form of technology with multiple uses. As a result, it has become extremely valuable to a number of businesses across

AI innovation

Companies Leading AI Innovation in 2023

Artificial intelligence (AI) has been transforming industries and revolutionizing business operations. AI’s potential to enhance efficiency and productivity has become crucial to many businesses. As we move into 2023, several

data fivetran pricing

Fivetran Pricing Explained

One of the biggest trends of the 21st century is the massive surge in analytics. Analytics is the process of utilizing data to drive future decision-making. With so much of

kubernetes logging

Kubernetes Logging: What You Need to Know

Kubernetes from Google is one of the most popular open-source and free container management solutions made to make managing and deploying applications easier. It has a solid architecture that makes