Password Storage in plsql developer

[admin]

Hi Marco,
I've been using plsql developer for some time now. Recently I've engaged with a different company and the company is considering purchasing plsql developer. I've been asked the question "How and where does plsql developer store database passwords?" this is an obvious concern. Please let me know.

 

[Marco Kalter]

By default PL/SQL Developer will not store database passwords.

If, however, you have enabled the "store password" option or if you enter the password in the "Define Connections" tool, then these passwords will be stored in an encrypted form.

 

[admin]

Thank you Marco.

 

[vrbcik]

Well, in PLSQL Dev version 9 the passwords are stored in "C:\Program Files\PLSQL Developer\Preferences\\user.prefs" . So if you copy them from one user to another (or if he can see this folder on the pc), he is able to connect to db in your account.

Which - considering internal security in most companies where I have worked - is a security hole, and cannot be admitted.

Is it mistake in the installation? Or how is it solved in PLSql Dev8, or PLsqldev 10?