Lost master password. How do I recover?

[defaria]

This all started when the passwords between my home computer and work computer got messed up. The password generated at home for my Wells Fargo page is different than the password generated at work for Wells Fargo. I usually use the upload/download thing to keep these in sync but that was failing with an error:

Exception: [Exception... "Component returned failure code: 0x80520001
(NS_ERROR_FILE_UNRECOGNIZED_PATH) [nsLocalFile.initWithPath]" nsresult:
"0x80520001 (NS_ERROR_FILE_UNRECOGNIZED_PATH)" location: JS frame ::
chrome://passwdmaker/content/updownload.js :: anonymous :: line 27" data: no]

So I exported my settings from work and imported them at home and things appeared to work. But now they've broken again. So I try to toggle the Mask Generated Password with Asterisks and it prompts for my master password. I type in the only master password I have - the only one I use - and it tells me that that is not the correct master password! Help!!!

Another odd thing is that I don't see any place to enter the master password anymore on the Password Maker Advanced Options dialog box.

[tanstaafl]

Another odd thing is that I don't see any place to enter the master password anymore on the Password Maker Advanced Options dialog box.

This must be the cause of your problem. The only time it prompts me for my MP is when there is something entered into the MP box when toggling it.

Can you see the 'I use more than one master password' option? Is it enabled?

Can you see the 'Store master password (on disk or in memory)' option? What is it set to?

Can you see the 'Master Password Hash' section? Have you stored the Master Password Hash for whatever account you are on when you try to toggle?

It sounds to me like your RDF file may be hosed... have you tried an older one from your backups (you do keep good backups, right?)?

[tanstaafl]

Oh... and to answer the question in your subject, see this F.A.Q.

[defaria]

Another odd thing is that I don't see any place to enter the master password anymore on the Password Maker Advanced Options dialog box.

This must be the cause of your problem. The only time it prompts me for my MP is when there is something entered into the MP box when toggling it.

Maybe it's a Windows vs. Linux thing. Here at home on Linux I see no place to enter theMP. I remember seeing it at work on Windows. I'll report back.

Can you see the 'I use more than one master password' option? Is it enabled?

Initially no. I tried toggling it on. It didn't seem to do any good.

Can you see the 'Store master password (on disk or in memory)' option? What is it set to?

Right now it says "Store". Likewise I click on it a few times to try all of the setting. Again, didn't seem to do anything. If I click it now it goes to "Clear" and says "Status of Global Hash Matches".

Can you see the 'Master Password Hash' section? Have you stored the Master Password Hash for whatever account you are on when you try to toggle?

It says "Master Password Hash" above the "Status of Global Hash Matches". I've both stored and cleared it.

It sounds to me like your RDF file may be hosed... have you tried an older one from your backups (you do keep good backups, right?)?

If I 1) new where this RDF file typically resides and 2) wasn't going through a major migration from Windows -> Ubuntu complete with a totally new machines then I'd normally say yes. But I can't say yes here. I do have an passwdmaker.rdf under ~/.mozilla/firefox/<profiledir>. But that's dated today... 

Regarding your pointer to the FAQ: But I haven't lost my MP really, in fact I've never changed it! It's always been the same but now password maker says it's wrong. That's what's strange. That and the fact that although I don't know my MP I can currently still use password maker by and large.

Assuming I eventually need to get my MP known again, two question. Firstly - how do I do that? Blow away password maker? Uninstall the extention? What?

Secondly, would I then have to re-establish each and every password I'm using at all of my web sites???
[/quote]

[defaria]

OK, here at work and I try to download my passwords from my server and I get a dialog box with the oh so helpful message "Error 0x-1"! What's that mean?

I don't see any edit boxes for the MPW so I guess I was wrong there...

I still don't know what my MPW is now nor how to correct this problem. PWM seems to work supplying passwords though.

[tanstaafl]

Hmmm... be careful... apparently you have saved your Master Password to disk, but since you cannot remember it, you cannot toggle any settings that require you to know it...

Since it *is* saved on disk, this is one situation where it just might be possible to somehow 'peek' at the password... but how to do so is beyond me...

Eric?

[Eric H. Jung]

You can get your master password back. Get the encryption key and encryptedMPW from passwordmaker.rdf. This uses AES-256 encryption, so you need an AES-256 decrypter. I think we had an online one I wrote on the passwordmaker.org website. Trying to find it...

[Eric H. Jung]

http://passwordmaker.sourceforge.net/crypt/
I *think* that uses AES-256, but w/o looking at the source code I can't remember for sure.

[tanstaafl]

Cool, thanks Eric... let us know if this works for you defaria...

[defaria]

I cannot find "encryption key" and "encryptedMPW" in my Passwords.rdf file. I do see "masterPasswordKey" and "masterPassword". I assume that's what you meant.

At http://passwordmaker.sourceforge.net/crypt/ I put masterPasswordKey in the Key edit box and masterPassword in the Cipher Text box. I then click on Decrypt. Nothing happens! 

I can put text in the Plain Text box and encrypt it. I can then decrypt that text. For grins I put in my expected master password (as I said, I'm sure it's the one I used - it's the only one I use for such master passwords typically) and tried to encrypt it.  I then took what it encrypted to and tried to stick it into a copy of Passwords.rdf and import that. It imported. I then tried to enter my master password... No joy! Still says it's wrong.

Note that "masterPassword" and "masterPasswordKey" appear in two sections of my Passwords.rdf file. One appears to be where I define my upload/download domain (defaria.com) and the other is in the global settings section. I dealt only with the later section here.

[Eric H. Jung]

The ones in global settings are the ones to use.

I checked http://passwordmaker.sourceforge.net/crypt/ and it does indeed use AES-256 (hopefully the same block size and mode as the PasswordMaker extension; I didn't check that).

If it's not decrypting, then you need another tool. have you googled for AES decyrpters?

[tanstaafl]

I saved mine to disk and tried it and got nothing either... looks like it is broken for some reason...

I looked for another online tool, but couldn't find a working one...

[Eric H. Jung]

It's not broken, it just does encryption differently than PasswordMaker does for its MPW.

[defaria]

The ones in global settings are the ones to use.

I checked http://passwordmaker.sourceforge.net/crypt/ and it does indeed use AES-256 (hopefully the same block size and mode as the PasswordMaker extension; I didn't check that).

If it's not decrypting, then you need another tool. have you googled for AES decyrpters?

No, the clock struck 9 Am and I decided it was time to go to work. I'll work more on this tonight when I get home. Thanks guys. Will report back. If I find a way to recover the password it would be good to document that procedure incase somebody else losses there's but has also saved away a copy of their .rdf file with the master password.

You had mentioned backup copies. Where are they normally kept? (Both Windows & Linux...)

[tanstaafl]

Will report back. If I find a way to recover the password it would be good to document that procedure incase somebody else losses there's but has also saved away a copy of their .rdf file with the master password.

I will absolutely be sure that this gets documented, and will give full attribution...

You had mentioned backup copies. Where are they normally kept? (Both Windows & Linux...)

Wherever you put them...

Passwordmaker doesn't create them automatically... I back mine up daily, and keep 365 copies... so I can go back in time as far as a full year with respect to my rdf file - its that important to me. Thankfully it is tiny and takes up very little space... I also keep this entire rdf file backup directory rsync'd to my online rsync.net backup account (encrypted of course), for disaster recovery purposes.

For me, being forced to give up passwordmaker+firefox would be worse than being forced to giving up broadband and having to go back to dial-up... I couldn't do it...