title: How secure is encryption provided by CryptProtectData API?
body: <p>Say, if I encrypt some text using <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa380261%28v=vs.85%29.aspx?f=255&amp;MSPPError=-2147217396" rel="nofollow noreferrer">CryptProtectData</a> API without specifying the <code>CRYPTPROTECT_LOCAL_MACHINE</code> flag. If I understood it correctly, doing so will allow only the user that my application was running under to decrypt it.</p>
  
  <p>Let's assume that I saved the resulting ciphertext data in <code>HKCU</code> registry key for my application. So obviously some other users (from other user accounts) will be able to read that data from registry.</p>
  
  <p>My question is, will any other user on that computer be able to decrypt it without having the initial user log in to that machine?</p>