The following components of can use passwords for authentication:

• When using remote iSCSI storage and the storage server requires authentication, an initiator secret can optionally be supplied with the VBoxManage storageattach command. As long as no settings password is provided, by using the command line option --settingspwfile, then this secret is stored unencrypted in the machine configuration and is therefore potentially readable on the host. See iSCSI Servers and .

• When using the web service to control an host remotely, connections to the web service are authenticated in various ways. This is described in detail in the Software Development Kit (SDK) reference. See .