Does Visual SourceSafe send clear text passwords over the network?
No. SourceSafe is a distributed client application. Each client accesses directly the VSS database; all passwords validations are done on client machines. The user typed-in password is hashed on the client machine and the hash is compared locally against the hash read from the VSS database. Note however that when 3rd party applications that provide remote-VSS functionality are used (client-server applications), those applications need to send the passwords to the server. They may or may not send the password over a secure channel… VSS 2005 Internet plugin does not send the password unless a secure channel is used (SSL). When http connections are used, the user can only login using automatic logon with Windows username (if the database is configured to allow such logins). I forgot my SourceSafe or Admin’s password, can I recover it? In most cases, no. Visual SourceSafe creates a 16-bit hash of the password typed by users and stores in the database only the hash. For a particular hash
