How is Secure Store Service storing passwords under the hood?

Question

When Business Connectivity Services need to access external data which requires per-user authentication, it uses Secure Store Service to store the user password in order to avoid asking for it again and again.

Since the external data source needs the password itself, and not its hash, it means that Secure Store Service records the password itself, probably not in plain text, but still in a way it can be decrypted.

Every MSDN article (such as this one) I've read about Secure Store Service explains the benefits of using it, but not the internal workings.

How are passwords actually stored? If encryption is used, how is the decryption key stored?

In other words, are passwords safe if, for instance, a malicious person obtains an exact copy of the hard disk of a server hosting Secure Store Service? What if at instant t, the person has access to both the hard disk and the memory?

Answer 1

This post goes very deep on the topic: https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=65

Answer 2

Using SharePoint API we can get the UserName and Password that is stored in Secure Store.

This will work only if the user context that the code is running is in the membership of the Target Application.

http://matthewyarlett.blogspot.com/2013/10/retrieving-credentials-from-sharepoint.html