4

In the special settings for the RPi OS installer you can specify the WiFi password for your network. It's already prefilled in. I can even see it by placing checkmark "show password".

According to this: https://answers.microsoft.com/en-us/windows/forum/all/where-are-the-passwords-of-my-wi-fi-networks-saved/5170ec32-92f9-4187-813f-478e7d6dba76 Windows is supposed to store WiFi passwords in encrypted vault files.

So, how does RPi OS installer manage to display my password if it's supposed to be encrypted?

5
  • your question does not really belong here ... it is a Windows question ... it's a better fit at superuser.com/questions
    – jsotola
    Jul 3, 2023 at 22:53
  • It's about Raspberry Pi OS installer, is it not? Jul 4, 2023 at 0:19
  • Raspberry Pi OS installer is a Windows program (at least on Windows). If you want to know about where Raspberry Pi OS keeps password it would be a Pi question. It works differently on macOS & Linux. Frankly I wouldn't use the Installer to set/keep my passwords. Even on the Pi I encode them.
    – Milliways
    Jul 4, 2023 at 1:31
  • It's about Raspberry Pi OS installer, is it not? ... no, it is about Windows making passwords available to a program
    – jsotola
    Jul 4, 2023 at 2:43
  • I've never seen any other program pulling secrets from encrypted keyvaults without explicit permision. The mac version of installer's code anctually generates a prompt that requests access to the OSX keychain. By your logic, many questions can be reasoned as unrelated because everything eventually is API/libraries in the end, unrelated to the bigger product. If mods decide to close this question, I'll delete it. But I think this question has value -- for people who are also weirded out by this convenient but creepy function and google to find out "how" and "why". Jul 4, 2023 at 18:57

1 Answer 1

5

Found out myself digging through the source code:

https://github.com/raspberrypi/rpi-imager/blob/b49408781a3c347bd6f6c057c68bb34d6c06ad10/src/windows/winwlancredentials.cpp

The WinWlanCredentials constructor is defined, which initializes the hWlanApi handle by loading the wlanapi.dll library using LoadLibraryExA function.

The constructor proceeds to open a handle to the WLAN API using WlanOpenHandle function. It checks if the handle was opened successfully and returns if there was an error.

The WLAN interfaces are enumerated using WlanEnumInterfaces function, and for each interface, the code checks if it is in the connected state. If not, it continues to the next interface.

The current connection information for the interface is obtained using WlanQueryInterface function with the wlan_intf_opcode_current_connection opcode. The SSID of the connected network is extracted from the obtained connection attributes.

If the SSID is empty, the code continues to the next interface.

The code then retrieves the list of WLAN profiles using WlanGetProfileList function.

It iterates through the list of profiles and checks if the profile name matches the SSID of the connected network.

If a matching profile is found, the code retrieves the XML content of the profile using WlanGetProfile function. It extracts the PSK from the XML using a regular expression and stores it in the _psk member variable.

--

So, the interesting part: In the Windows-specific implementation provided, the code retrieves the Wi-Fi password (PSK) from the WLAN profile stored on the system. The password is obtained in plaintext form directly from the profile, without encryption.

When a user connects to a Wi-Fi network and enters the password, Windows stores the network's profile, including the SSID and the password, on the system. By default, the password is stored in an encrypted form in the WLAN profile XML file. However, Windows provides an API function called WlanGetProfile with the WLAN_PROFILE_GET_PLAINTEXT_KEY flag, which allows retrieving the password in plaintext form.

The ability to retrieve the password in plaintext form requires administrative privileges (regular users do not have access to the plaintext password through the WLAN API). I.e., if the code is running with administrative privileges, it can retrieve the password using the WlanGetProfile function with the appropriate flag.

However, I feel like it's a bad design in Windows--that permisions for a process launched by an admin are blanket and not granular: you may want to install an app, but it doesn't mean you necessarily want it to be able to siphon in your credentials.

3
  • 1
    Thanks for the info - this is useful research.
    – Seamus
    Jul 4, 2023 at 22:28
  • 1
    Whatever they may say above, Windows issue or not, it's great you exposed a weak point of Windows which I also didn't know of. Everyone with admin privileges can, with the necessary calls, see your WiFi password. Just like that? Frightening.
    – GeertVc
    Jul 7, 2023 at 16:42
  • Yeah, even more frightening for an average person who oftentimes reuse their passwords (even though they shouldn't). Jul 7, 2023 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.