A password is stored in plain text when you add the password to a catalog in Expression Media

You add a password to a catalog in Microsoft Expression Media. Then, you save the catalog as CatalogName.ivc file. However, anyone can open the CatalogName.ivc file to retrieve the password by using Notepad on a Windows-based computer or by using TextEdit on an Apple Macintosh computer.

This problem occurs because Expression Media stores the password in plain text in the .ivc file.

To work around this problem, use file-system-based security to limit access to the .ivc file. To do this, follow these steps.

For Windows-based computers

1. Start Windows Explorer, and then locate the .ivc file.
2. Right-click the .ivc file, and then click Properties.
3. Click the Security tab, and then click Edit.
4. Under Group or user names, click the Windows account for which you want to deny permission, and then click Edit.
5. Under Permissions for Windows account, click to select the Deny check box for Read.
6. Click OK two times.

For Macintosh computers

1. Log on to a Macintosh-based computer as an administrator.
2. Click System Preferences, and then click Security.
3. Under For all accounts on this computer, click to select the Disable automatic login check box.
4. Click Turn on FileVault.
   
   Note If there is no master password, a dialog box opens so that you can create a master password.
5. Enter a master password, and then confirm the master password.
6. Click Turn on FileVault.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.