PasswordMaker Forums
Firefox/SeaMonkey/Mozilla/Netscape/Flock Browser Extension => Help and Support => Topic started by: defaria on April 23, 2009, 02:52:53 AM
-
This all started when the passwords between my home computer and work computer got messed up. The password generated at home for my Wells Fargo page is different than the password generated at work for Wells Fargo. I usually use the upload/download thing to keep these in sync but that was failing with an error:
Exception: [Exception... "Component returned failure code: 0x80520001
(NS_ERROR_FILE_UNRECOGNIZED_PATH) [nsLocalFile.initWithPath]" nsresult:
"0x80520001 (NS_ERROR_FILE_UNRECOGNIZED_PATH)" location: JS frame ::
chrome://passwdmaker/content/updownload.js :: anonymous :: line 27" data: no]
So I exported my settings from work and imported them at home and things appeared to work. But now they've broken again. So I try to toggle the Mask Generated Password with Asterisks and it prompts for my master password. I type in the only master password I have - the only one I use - and it tells me that that is not the correct master password! Help!!!
Another odd thing is that I don't see any place to enter the master password anymore on the Password Maker Advanced Options dialog box.
-
Another odd thing is that I don't see any place to enter the master password anymore on the Password Maker Advanced Options dialog box.
This must be the cause of your problem. The only time it prompts me for my MP is when there is something entered into the MP box when toggling it.
Can you see the 'I use more than one master password' option? Is it enabled?
Can you see the 'Store master password (on disk or in memory)' option? What is it set to?
Can you see the 'Master Password Hash' section? Have you stored the Master Password Hash for whatever account you are on when you try to toggle?
It sounds to me like your RDF file may be hosed... have you tried an older one from your backups (you do keep good backups, right?)?
-
Oh... and to answer the question in your subject, see this F.A.Q. (http://passwordmaker.org/F.A.Q.#What_if_I_forget_my_Master_Password.3F)
-
Another odd thing is that I don't see any place to enter the master password anymore on the Password Maker Advanced Options dialog box.
This must be the cause of your problem. The only time it prompts me for my MP is when there is something entered into the MP box when toggling it.
Maybe it's a Windows vs. Linux thing. Here at home on Linux I see no place to enter theMP. I remember seeing it at work on Windows. I'll report back.
Can you see the 'I use more than one master password' option? Is it enabled?
Initially no. I tried toggling it on. It didn't seem to do any good.
Can you see the 'Store master password (on disk or in memory)' option? What is it set to?
Right now it says "Store". Likewise I click on it a few times to try all of the setting. Again, didn't seem to do anything. If I click it now it goes to "Clear" and says "Status of Global Hash Matches".
Can you see the 'Master Password Hash' section? Have you stored the Master Password Hash for whatever account you are on when you try to toggle?
It says "Master Password Hash" above the "Status of Global Hash Matches". I've both stored and cleared it.
It sounds to me like your RDF file may be hosed... have you tried an older one from your backups (you do keep good backups, right?)?
If I 1) new where this RDF file typically resides and 2) wasn't going through a major migration from Windows -> Ubuntu complete with a totally new machines then I'd normally say yes. But I can't say yes here. I do have an passwdmaker.rdf under ~/.mozilla/firefox/<profiledir>. But that's dated today... :'(
Regarding your pointer to the FAQ: But I haven't lost my MP really, in fact I've never changed it! It's always been the same but now password maker says it's wrong. That's what's strange. That and the fact that although I don't know my MP I can currently still use password maker by and large.
Assuming I eventually need to get my MP known again, two question. Firstly - how do I do that? Blow away password maker? Uninstall the extention? What?
Secondly, would I then have to re-establish each and every password I'm using at all of my web sites???
[/quote]
-
OK, here at work and I try to download my passwords from my server and I get a dialog box with the oh so helpful message "Error 0x-1"! What's that mean?
I don't see any edit boxes for the MPW so I guess I was wrong there...
I still don't know what my MPW is now nor how to correct this problem. PWM seems to work supplying passwords though.
-
Hmmm... be careful... apparently you have saved your Master Password to disk, but since you cannot remember it, you cannot toggle any settings that require you to know it...
Since it *is* saved on disk, this is one situation where it just might be possible to somehow 'peek' at the password... but how to do so is beyond me...
Eric?
-
You can get your master password back. Get the encryption key and encryptedMPW from passwordmaker.rdf. This uses AES-256 encryption, so you need an AES-256 decrypter. I think we had an online one I wrote on the passwordmaker.org website. Trying to find it...
-
http://passwordmaker.sourceforge.net/crypt/
I *think* that uses AES-256, but w/o looking at the source code I can't remember for sure.
-
Cool, thanks Eric... let us know if this works for you defaria...
-
I cannot find "encryption key" and "encryptedMPW" in my Passwords.rdf file. I do see "masterPasswordKey" and "masterPassword". I assume that's what you meant.
At http://passwordmaker.sourceforge.net/crypt/ I put masterPasswordKey in the Key edit box and masterPassword in the Cipher Text box. I then click on Decrypt. Nothing happens! :'(
I can put text in the Plain Text box and encrypt it. I can then decrypt that text. For grins I put in my expected master password (as I said, I'm sure it's the one I used - it's the only one I use for such master passwords typically) and tried to encrypt it. I then took what it encrypted to and tried to stick it into a copy of Passwords.rdf and import that. It imported. I then tried to enter my master password... No joy! Still says it's wrong.
Note that "masterPassword" and "masterPasswordKey" appear in two sections of my Passwords.rdf file. One appears to be where I define my upload/download domain (defaria.com) and the other is in the global settings section. I dealt only with the later section here.
-
The ones in global settings are the ones to use.
I checked http://passwordmaker.sourceforge.net/crypt/ and it does indeed use AES-256 (hopefully the same block size and mode as the PasswordMaker extension; I didn't check that).
If it's not decrypting, then you need another tool. have you googled for AES decyrpters?
-
I saved mine to disk and tried it and got nothing either... looks like it is broken for some reason...
I looked for another online tool, but couldn't find a working one...
-
It's not broken, it just does encryption differently than PasswordMaker does for its MPW.
-
The ones in global settings are the ones to use.
I checked http://passwordmaker.sourceforge.net/crypt/ and it does indeed use AES-256 (hopefully the same block size and mode as the PasswordMaker extension; I didn't check that).
If it's not decrypting, then you need another tool. have you googled for AES decyrpters?
No, the clock struck 9 Am and I decided it was time to go to work. I'll work more on this tonight when I get home. Thanks guys. Will report back. If I find a way to recover the password it would be good to document that procedure incase somebody else losses there's but has also saved away a copy of their .rdf file with the master password.
You had mentioned backup copies. Where are they normally kept? (Both Windows & Linux...)
-
Will report back. If I find a way to recover the password it would be good to document that procedure incase somebody else losses there's but has also saved away a copy of their .rdf file with the master password.
I will absolutely be sure that this gets documented, and will give full attribution...
You had mentioned backup copies. Where are they normally kept? (Both Windows & Linux...)
Wherever you put them... ;)
Passwordmaker doesn't create them automatically... I back mine up daily, and keep 365 copies... so I can go back in time as far as a full year with respect to my rdf file - its that important to me. Thankfully it is tiny and takes up very little space... I also keep this entire rdf file backup directory rsync'd to my online rsync.net backup account (encrypted of course), for disaster recovery purposes.
For me, being forced to give up passwordmaker+firefox would be worse than being forced to giving up broadband and having to go back to dial-up... I couldn't do it...
-
Well I didn't do a lot of searching but I did come across the following: http://www.rsgate.com/encrypt/ I tried all knds of combinations of the "masterPasswordKey" and "masterPassword" in several of .rdf files that I was able to find. In every instance I got "Invalid Key" when I tried to decrypt the MPW. Are we sure that PasswordMaker is writing out the correct encryption strings to the .rdf file?
-
I'm working on writing a web page for you to recover the MPW. i'd appreciate it if you'd consider donating (http://passwordmaker.org/Donations_and_Expenses) since i'm doing this exclusively for you.
-
OK, here it is. (http://foxyproxy.mozdev.org/decrypt.html)
I can't find the login credentials for passwordmaker.org's hosting shell account, otherwise I'd add it to http://passwordmaker.org. Tanstaafl, can you help with that? The page (http://foxyproxy.mozdev.org/decrypt.html) is self-contained. In other words, you can "View Source", copy and paste into a new file, and upload to http://passwordmaker.org (somewhere outside the wiki, of course, since I don't think plain old HTML and Javascript will work in the wiki).
defaria.
Please do consider donating (http://passwordmaker.org/Donations_and_Expenses).
Thank you,
Eric
-
OK, here it is. (http://foxyproxy.mozdev.org/decrypt.html)
Thanks Eric...
I can't find the login credentials for passwordmaker.org's hosting shell account, otherwise I'd add it to http://passwordmaker.org. Tanstaafl, can you help with that? The page (http://foxyproxy.mozdev.org/decrypt.html) is self-contained. In other words, you can "View Source", copy and paste into a new file, and upload to http://passwordmaker.org (somewhere outside the wiki, of course, since I don't think plain old HTML and Javascript will work in the wiki).
Done, I put it here:
http://passwordmaker.org/decrypt.htm
I tested it too and confirm it worked for me...
-
i updated the original page with a notice that nothing is submitted... can you update the page? I think we should also document it somewhere on the wiki. No rush, of course.
-
i updated the original page with a notice that nothing is submitted... can you update the page?
? I don't understand... you updated it, and you want me to update it? ;)
I can't get into the sourceforge site, can't remember the password...
I think we should also document it somewhere on the wiki. No rush, of course.
Updated the appropriate F.A.Q. (http://passwordmaker.org/F.A.Q.#What_if_I_forget_my_Master_Password.3F).
-
i updated the original page with a notice that nothing is submitted... can you update the page?
? I don't understand... you updated it, and you want me to update it? ;)
I updated this page (http://foxyproxy.mozdev.org/decrypt.html). Can you update this page (http://passwordmaker.org/decrypt.htm) with the text at the top:
This page does not submit any information over the internet. All processing is done in your browser. You shouldn't trust me (a stranger), so if you can't understand the code of this page (press cntrl-U in Firefox to see it), you should save this page locally, unplug your internet connection, open the local page in a browser, and use it to decrypt your password.
Updated the appropriate F.A.Q. (http://passwordmaker.org/F.A.Q.#What_if_I_forget_my_Master_Password.3F).
The link was wrong, but I fixed it. Thanks for writing this up!
-
I updated this page (http://foxyproxy.mozdev.org/decrypt.html). Can you update this page (http://passwordmaker.org/decrypt.htm) with the text at the top:
Oh... heh... ok, done. Hope you don't mind, but I reformatted the page a little...
http://passwordmaker.org/decrypt.htm
-
Thanks. Looks good! I'm removing http://foxyproxy.mozdev.org/decrypt.html
-
I'm working on writing a web page for you to recover the MPW. i'd appreciate it if you'd consider donating (http://passwordmaker.org/Donations_and_Expenses) since i'm doing this exclusively for you.
Tell ya what. If it decrypts my master password such that I can use it again I'll donate. But alas it didn't. Putting in my masterPassword and masterPasswordKey and I get nothing!
OMG! I got it!!! As I said there are two masterPassword/masterPasswordKeys in my .rdf files. When I tried the second one it worked! Hmmm... An older password for sure. Now how to I change it?
Meantime I'll look into the donate thing... Ugh, I haven't used Paypal for a while... OK I did it with a credit card instead.
-
OMG! I got it!!!
Cool, glad this worked for you... lucky you had stored it on disk...
As I said there are two masterPassword/masterPasswordKeys in my .rdf files. When I tried the second one it worked! Hmmm... An older password for sure.
Are you sure? There should be only one in the 'globalSettings' section of the RDF file... if there is more than one, something is definitely awry...
Now how to I change it?
It sounds like you still aren't crystal clear on how this works...
You don't change it... just make a note of it so you don't forget it again, then change the 'Store Master Password' option to 'Not at all' - this will delete the saved one from the RDF file, and now you can use whatever you want when prompted. If you only use one, and are ok with the risk of storing it on disk (someone else with physical access to your PC could discover your Master Password the same way you just did)
Remember... the ability to store it is for convenience only, and really is NOT recommended, since it is a security risk.
Also, if you choose to use more than one Master Password, storing the Master Password, will effectively disable the option to 'Use more than one Master Password', which I do - I use different Master Passwords based on account types - one MPW for financial related sites, another for webmail accounts, etc...
-
As I said there are two masterPassword/masterPasswordKeys in my .rdf files. When I tried the second one it worked! Hmmm... An older password for sure.
Are you sure? There should be only one in the 'globalSettings' section of the RDF file... if there is more than one, something is definitely awry...
Right. There's only one in the globalSettings section of the RDF file. But there is another in my RDF file associated with the upload/download section. You see I run my own server and I decided to set up an area to upload PasswordMaker stuff too. That masterPassword and masterPasswordKey doesn't work with this new decrypt web page. Is the encryption different?
Now how to I change it?
It sounds like you still aren't crystal clear on how this works...
You don't change it... just make a note of it so you don't forget it again, then change the 'Store Master Password' option to 'Not at all' - this will delete the saved one from the RDF file, and now you can use whatever you want when prompted.
It's that last portion, "now you can use whatever you want when prompted", that's still not working for me. Let's be clear. I don't see a "Store Master Password" option at all. I do see a "Master Password" and "Master Password Hash" sections in the PasswordMaker Advanced Options dialog box but no "Store Master Password" option. The closest thing is under Master Password Hash it says "Status of Global Hash", its status and a button to toggle. I've toggled it until it says "Not stored on disk" but I can't find how to get it to "Not at all".
After performing that action I tried to toggle off Mask Generated Password with Asterisks, for example, and it prompts me for my Master Password. According to you statement above "I can use whatever I want" so I try any old thing. Nothing works except for my Master Password recently decrypted so I'm perplexed by your statement.
If you only use one, and are ok with the risk of storing it on disk (someone else with physical access to your PC could discover your Master Password the same way you just did)
Remember... the ability to store it is for convenience only, and really is NOT recommended, since it is a security risk.
I live alone and my computers and disks are fairly locked up. I'm not concerned.
-
As I said there are two masterPassword/masterPasswordKeys in my .rdf files. When I tried the second one it worked! Hmmm... An older password for sure.
Are you sure? There should be only one in the 'globalSettings' section of the RDF file... if there is more than one, something is definitely awry...
Right. There's only one in the globalSettings section of the RDF file. But there is another in my RDF file associated with the upload/download section. You see I run my own server and I decided to set up an area to upload PasswordMaker stuff too. That masterPassword and masterPasswordKey doesn't work with this new decrypt web page. Is the encryption different?
Thats a question for Eric... I gave up trying to do this with PWM, I use a different backup program to sync my RDF file...
Now how to I change it?
It sounds like you still aren't crystal clear on how this works...
You don't change it... just make a note of it so you don't forget it again, then change the 'Store Master Password' option to 'Not at all' - this will delete the saved one from the RDF file, and now you can use whatever you want when prompted.
It's that last portion, "now you can use whatever you want when prompted", that's still not working for me. Let's be clear. I don't see a "Store Master Password" option at all. I do see a "Master Password" and "Master Password Hash" sections in the PasswordMaker Advanced Options dialog box but no "Store Master Password" option.
Then something is seriously fubar'd...
The 'Store Master Password' option is a select box option below/between the 'Master Password' text entry box and the 'Using Text' text box...
Do you see the 'Using Text' text box? This one is immediately above the 'Master Password Hash' section.
The closest thing is under Master Password Hash it says "Status of Global Hash", its status and a button to toggle. I've toggled it until it says "Not stored on disk" but I can't find how to get it to "Not at all".
Not surprising, since this is not the option I am talking about... it is behaving as advertised...
All that does is store a hash of the MPW for visually confirming whether the hash of the MPW you typed matches the hash of the one you stored (which would mean that you typed the correct Master Password).
After performing that action I tried to toggle off Mask Generated Password with Asterisks, for example, and it prompts me for my Master Password. According to you statement above "I can use whatever I want" so I try any old thing. Nothing works except for my Master Password recently decrypted so I'm perplexed by your statement.
If you really cannot see the 'Store Master Password [select box here]', the I am not surprised by your confusion. As I said, if it really isn't there, something is seriously messed up.
-
I think he's looking in the wrong drop-down listbox. defaria, do you see the attached screenshot?
-
Thanks eric - I meant to go back and edit my post and attach a screenshot, but its been a busy morning...
-
I recall seeing that dialog box but I no longer see it that way. Here's what I see now... Dang how do I upload a screen shot! I'm here at my client's and they don't allow me access to any kind of photo sharing sites, nor even ftp to my own server! Ugh! I'll upload it tonight. Basically that Master Password section only has "Using Text", "Generated Password" and "Copy Generated Password" button.
-
What version of Passwordmaker?
-
And what version of Firefox?
-
Sounds like you're in Basic Options mode. Click the "Advanced Options" hyperlink where it says, "The password was generated using the default account settings. Use the Advanced Options to change them."
-
I still see the 'Store Master Password' option in Basic mode...
-
FF 3.0.9
PM 1.7.2
I'm in advanced mode already.
Screen shot tonight.
(http://defaria.com/Images/tmp/PasswordMaker.png)
-
You're on the Global Settings Tab. This is only where you change Global settings.
Click on the 'Accounts' tab... this is where you can actually use your accounts... enter your Master Password to generate your account passwords... choose to 'Store Master Password'... etc...
WARNING: if you choose to change the 'Store Master Password' option from 'On Disk' (which is where it is now) to 'Not at all', this affects ALL accounts... so be very sure you correctly wrote down (copied/pasted) the one that you decoded from the page Eric created for you...
:)
-
You're on the Global Settings Tab. This is only where you change Global settings.
Click on the 'Accounts' tab... this is where you can actually use your accounts... enter your Master Password to generate your account passwords... choose to 'Store Master Password'... etc...
I hate to be dense but I can click on the Accounts tab. Still don't have a place to enter my Master Password though:
(http://defaria.com/Images/tmp/PasswordMaker2.png)
How do I get those two password edit boxes under Master Password to appear again??? I know I've seen them before I can't for the life of me remember how to get them to appear again!
-
Oh... duh...
Go back to Global settings and uncheck 'Hide Master Password Field'...
Sorry I missed that before...
-
OK, got it now. This is why I always attempt to use the verbiage I see on the dialog box or screen and that I verify the steps by doing them myself as I compose an answer. It helps cut back on the smacking oneself in the forehead and saying "Oh yeah I forgot". Not foolproof but it does help...
Additionally I noticed: If I toggle off "Hide Master Password (number of asterisks)" master password disappears!!! Now with "number of askterisks" I would have thought that this toggle toggles on a bunch of asterisks for the master password or the actual cleartext for the master password. But it doesn't do that, it removes the master password entirely.
The "Confirm master password by typeing it twice instead of once" is what adds a second master password edit box.
Now I'm able to change my master password by selecting Store master password to Not at all then entering in a new password.
I then uploaded to my server (defaria.com). I expect that I can download from my server when I get home and my master password will be what I set it to at work - no?
-
Additionally I noticed: If I toggle off "Hide Master Password (number of asterisks)" master password disappears!!! Now with "number of askterisks" I would have thought that this toggle toggles on a bunch of asterisks for the master password or the actual cleartext for the master password. But it doesn't do that, it removes the master password entirely.
Right. It's supposed to do that... some people don't want to reveal the length of their passwords to onlookers. There's also an option to reveal the master password entirely (no asterisks). I see your system doesn't use asterisks, but round circles instead. I should have worded that more generally.
I then uploaded to my server (defaria.com). I expect that I can download from my server when I get home and my master password will be what I set it to at work - no?
yes
-
Might I suggest either "Hide Master Password" or "Hide Master Password Completely". The "number of asterisks" part was confusing to me, not because my system (Ubuntu) choose to use circles rather than asterisks, rather because this phrasing does nothing (for me at least) to indicate that it was length that was being hidden. My suggestion also does not touch on the concept of length but I think it more plainly states "Just get rid of the master password entirely - don't show it (thus also hiding its length)". Sometimes simple wording of simple concepts are best...
Will test out the download/new password thing at home.
-
I see circles too, on Windows XP Pro sp3...
Also - you are aware that using a different Master Password will result in different generated passwords for all of your accounts, right? Meaning, you'll have to change the password for each account using the new Master Password, before it will 'just work', especially if you are storing it...
Anyway, glad you got it sorted...
-
Interestingly, I've had no such problems when changing my master password from <old password> -> <new password>.
-
The Master Password itself is used as one of the 'pieces' that PWM uses to calculate the generated password.
It is virtually impossible for you to generate the same password with two different Msster Passwords.
So, if entering a different Master Password results in the same generated password, then again, something is massively broken...