Most software uses the registry or an ASCII file to store data, and most times vendors don’t encrypt the data; this is the case with Thunderbird and Pigin for example.

In comparison a physically disconnected storage with an AES based protection would be nice for backups, but real time protection is way more important.

Password Safe, Group policies, DEP, and Signed driver loading are about as good as real time protection gets on windows. With this setup data is stored correctly for the most part(considering no auto-logins,) vulnerable processes are very unlikely to run shellcode with stack based overflows, and rootkits are restricted to userland. Also group policies restrict privileges to malware.

i’ve made a habit of not criticizing the posts on this site. although it’s incredibly difficult right now I’m going to stick with that. goodnight.

I run everything under DEP and configured signed driver loading, services, and group policies. I don’t run a firewall, and use free avira with it’s I/O monitoring/guard.

Most people just assume that because source code is available, the code is correct and efficient.