'WaitList.dat' Windows File May Be Secretly Hoarding Your Passwords, Emails (zdnet.com) 40
A file named WaitList.dat, found only on touchscreen-capable Windows PCs, may be collecting your sensitive data like passwords and emails. According to ZDNet, in order for the file to exist users have to enable "the handwriting recognition feature that automatically translates stylus/touchscreen scribbles into formatted text." From the report: The handwriting to formatted text conversion feature has been added in Windows 8, which means the WaitList.dat file has been around for years. The role of this file is to store text to help Windows improve its handwriting recognition feature, in order to recognize and suggest corrections or words a user is using more often than others. "In my testing, population of WaitList.dat commences after you begin using handwriting gestures," [Digital Forensics and Incident Response expert Barnaby Skeggs] told ZDNet in an interview. "This 'flicks the switch' (registry key) to turn the text harvester functionality (which generates WaitList.dat) on." "Once it is on, text from every document and email which is indexed by the Windows Search Indexer service is stored in WaitList.dat. Not just the files interacted via the touchscreen writing feature," Skeggs says.
Since the Windows Search Indexer service powers the system-wide Windows Search functionality, this means data from all text-based files found on a computer, such as emails or Office documents, is gathered inside the WaitList.dat file. This doesn't include only metadata, but the actual document's text. "The user doesn't even have to open the file/email, so long as there is a copy of the file on disk, and the file's format is supported by the Microsoft Search Indexer service," Skeggs told ZDNet. "On my PC, and in my many test cases, WaitList.dat contained a text extract of every document or email file on the system, even if the source file had since been deleted," the researcher added. Furthermore, Skeggs says WaitList.dat can be used to recover text from deleted documents.
Since the Windows Search Indexer service powers the system-wide Windows Search functionality, this means data from all text-based files found on a computer, such as emails or Office documents, is gathered inside the WaitList.dat file. This doesn't include only metadata, but the actual document's text. "The user doesn't even have to open the file/email, so long as there is a copy of the file on disk, and the file's format is supported by the Microsoft Search Indexer service," Skeggs told ZDNet. "On my PC, and in my many test cases, WaitList.dat contained a text extract of every document or email file on the system, even if the source file had since been deleted," the researcher added. Furthermore, Skeggs says WaitList.dat can be used to recover text from deleted documents.
Re:I propose an experiment: (Score:5, Insightful)
Wrong solution to a different problem.
Instead, stop shitty Operating Systems that don't understand security.
Re: Only a fucking millennial (Score:4, Funny)
An index describes the positional status of a single playing card relative to a stack of them.
Some are out of the decks (outdex) and some are in the decks (index).
Re: (Score:1)
An index should probably be shorter than the material it indexes. That implies discarding some data. Like maybe the order of words in the document, or how often they are repeated. Especially in this context where you're hoping to basically store unique words.
Re:Only a fucking millennial (Score:5, Informative)
It's effectively acting as an indexing keylogger too, though. Not just the contents of documents.
Re: (Score:2)
Yeah but being 100% optional and also quite clear on that feature I don't know what else people thought ticking this box would achieve.
"I want you to watch what I type so you get to know me better, ... oh but don't watch what I type!"
Re: (Score:2)
Passphrases that are obviously not single dictionary words could easily be excluded. And passwords that have spaces in them would already be broken up in the index. It's the lack of a validating dictionary that makes it a problem.
Re: (Score:2)
And passwords that have spaces in them would already be broken up in the index.
Why would you assume that? One of the biggest problems with handwriting recognition is the inability to recognise non-dictionary words and unexpected spaces
Re: (Score:2)
I should have said that as passphrases (with dictionary words).
Re: (Score:2)
From people who type their passwords in to clear-text documents that Windows Search Indexer can index.
Re: (Score:1)
From people who type their passwords in to clear-text documents that Windows Search Indexer can index.
Or if someone sent you a password in email.
Re: (Score:3)
I've had that discussion, many times. "No one is interested in us", "The email is internal", and "They won't get it any other way". The prize foolishness was the head of security who insisted on sending user's login passwords, in plain text email, so that he would have a copy and be able to test it if they reported problems, set no expiration policy for these new passwords, and set no "must change password on first use" policy. The result was that obsolete email set to people who were still employed but nev
Re: (Score:2)
If it indexes things in the Clipboard, that's going to be all the passwords if you're security conscious and using a password manager.
Comment removed (Score:3, Interesting)
Re: Water is wet, sky is blue.. (Score:3, Insightful)
Don't fool yourself. It has never been solid.
Security-wise you used to get worms before the setup for the installer was ready.
Re: (Score:2)
and security has become a punchline under Nutella
How so? Based on past performance our chocolaty fiend has a long way to go before he oversees security dramas even remotely the size of the previous two CEOs. Sure MS doesn't have a great reputation, but to claim it has become a punchline under Nutella isn't at all backed up by any data, or any of your examples (unless you are confusing the words security and reliability in which case I wholeheartedly continue to disagree since this trend was started with Windows 8 under the watchful eye of the Ranting Monk
Re: (Score:2)
Re: (Score:2)
Dude the OS is dumping highly sensitive data in the equivalent of a .txt file...
A process that was also present in Windows 8 which introduced the feature. Just because it was discovered NOW doesn't back up the notion that security has gotten worse under Nudella. It only serves to reinforce how shitty it was under Balmer and that it hasn't gotten any better.
BTW look up "Windows 10 vulnerability" to see that yeah their security is going downhill
Look up Windows 8 vulnerability to see that it hasn't budged. Or maybe compare it to Windows 7 pre-SP1 days. Windows security is a joke, but it always has been. It has historically and universally taken several years of bug fixing to
Modest news (Score:2)
Nothing super threatening--you have to opt-in. Nobody known was affected. And Microsoft will have a patch out within like, two weeks.
I mean, it's good to know about this stuff to watch for trends. But this will have zero effect on anyone's lives, nor Microsoft's stock. Like a murderer, goes on trial, and goes to jail. You can talk about trends maybe, but the murderer is already in jail. He's not a direct threat to any of us. So it's not like "tonight at 10. this thing in your house WILL KILL YOUR CHILDREN i
Windows had handwriting recognition in XP (Score:1)
It was not introduced in windows 8 like the OP says. Now, this could be a newer feature of the handwriting service that was introduced in 8, I don't know. Also mentioned is a registry key that activates this feature, so you could use that to disable it.
An idea that I just had involves taking ownership of that file (or create an empty one in its place), set it to read only, and revoke permissions from every user, including SYSTEM. That may prevent the file from getting populated (search or handwriting featur