Lost master password. How do I recover?

[defaria]

Well I didn't do a lot of searching but I did come across the following: http://www.rsgate.com/encrypt/ I tried all knds of combinations of the "masterPasswordKey" and "masterPassword" in several of .rdf files that I was able to find. In every instance I got "Invalid Key" when I tried to decrypt the MPW. Are we sure that PasswordMaker is writing out the correct encryption strings to the .rdf file?

[Eric H. Jung]

I'm working on writing a web page for you to recover the MPW. i'd appreciate it if you'd consider donating since i'm doing this exclusively for you.

[Eric H. Jung]

OK, here it is.

I can't find the login credentials for passwordmaker.org's hosting shell account, otherwise I'd add it to http://passwordmaker.org. Tanstaafl, can you help with that? The page is self-contained. In other words, you can "View Source", copy and paste into a new file, and upload to http://passwordmaker.org (somewhere outside the wiki, of course, since I don't think plain old HTML and Javascript will work in the wiki).

defaria.
Please do consider donating.

Thank you,
Eric

[tanstaafl]

OK, here it is.

Thanks Eric...

I can't find the login credentials for passwordmaker.org's hosting shell account, otherwise I'd add it to http://passwordmaker.org. Tanstaafl, can you help with that? The page is self-contained. In other words, you can "View Source", copy and paste into a new file, and upload to http://passwordmaker.org (somewhere outside the wiki, of course, since I don't think plain old HTML and Javascript will work in the wiki).

Done, I put it here:

http://passwordmaker.org/decrypt.htm

I tested it too and confirm it worked for me...

[Eric H. Jung]

i updated the original page with a notice that nothing is submitted... can you update the page? I think we should also document it somewhere on the wiki. No rush, of course.

[tanstaafl]

i updated the original page with a notice that nothing is submitted... can you update the page?

? I don't understand... you updated it, and you want me to update it?

I can't get into the sourceforge site, can't remember the password...

I think we should also document it somewhere on the wiki. No rush, of course.

Updated the appropriate F.A.Q..

[Eric H. Jung]

i updated the original page with a notice that nothing is submitted... can you update the page?

? I don't understand... you updated it, and you want me to update it?

I updated this page. Can you update this page with the text at the top:

This page does not submit any information over the internet. All processing is done in your browser. You shouldn't trust me (a stranger), so if you can't understand the code of this page (press cntrl-U in Firefox to see it), you should save this page locally, unplug your internet connection, open the local page in a browser, and use it to decrypt your password.

Updated the appropriate F.A.Q..

The link was wrong, but I fixed it. Thanks for writing this up!

[tanstaafl]

I updated this page. Can you update this page with the text at the top:

Oh... heh... ok, done. Hope you don't mind, but I reformatted the page a little...

http://passwordmaker.org/decrypt.htm

[Eric H. Jung]

Thanks. Looks good! I'm removing http://foxyproxy.mozdev.org/decrypt.html

[defaria]

I'm working on writing a web page for you to recover the MPW. i'd appreciate it if you'd consider donating since i'm doing this exclusively for you.

Tell ya what. If it decrypts my master password such that I can use it again I'll donate. But alas it didn't. Putting in my masterPassword and masterPasswordKey and I get nothing!

OMG! I got it!!! As I said there are two masterPassword/masterPasswordKeys in my .rdf files. When I tried the second one it worked! Hmmm... An older password for sure. Now how to I change it?

Meantime I'll look into the donate thing... Ugh, I haven't used Paypal for a while... OK I did it with a credit card instead.

[tanstaafl]

OMG! I got it!!!

Cool, glad this worked for you... lucky you had stored it on disk...

As I said there are two masterPassword/masterPasswordKeys in my .rdf files. When I tried the second one it worked! Hmmm... An older password for sure.

Are you sure? There should be only one in the 'globalSettings' section of the RDF file... if there is more than one, something is definitely awry...

Now how to I change it?

It sounds like you still aren't crystal clear on how this works...

You don't change it... just make a note of it so you don't forget it again, then change the 'Store Master Password' option to 'Not at all' - this will delete the saved one from the RDF file, and now you can use whatever you want when prompted. If you only use one, and are ok with the risk of storing it on disk (someone else with physical access to your PC could discover your Master Password the same way you just did)

Remember... the ability to store it is for convenience only, and really is NOT recommended, since it is a security risk.

Also, if you choose to use more than one Master Password, storing the Master Password, will effectively disable the option to 'Use more than one Master Password', which I do - I use different Master Passwords based on account types - one MPW for financial related sites, another for webmail accounts, etc...

[defaria]

As I said there are two masterPassword/masterPasswordKeys in my .rdf files. When I tried the second one it worked! Hmmm... An older password for sure.

Are you sure? There should be only one in the 'globalSettings' section of the RDF file... if there is more than one, something is definitely awry...

Right. There's only one in the globalSettings section of the RDF file. But there is another in my RDF file associated with the upload/download section. You see I run my own server and I decided to set up an area to upload PasswordMaker stuff too. That masterPassword and masterPasswordKey doesn't work with this new decrypt web page. Is the encryption different?

Now how to I change it?

It sounds like you still aren't crystal clear on how this works...

You don't change it... just make a note of it so you don't forget it again, then change the 'Store Master Password' option to 'Not at all' - this will delete the saved one from the RDF file, and now you can use whatever you want when prompted.

It's that last portion, "now you can use whatever you want when prompted", that's still not working for me. Let's be clear. I don't see a "Store Master Password" option at all. I do see a "Master Password"  and "Master Password Hash" sections in the PasswordMaker Advanced Options dialog box but no "Store Master Password" option. The closest thing is under Master Password Hash it says "Status of Global Hash", its status and a button to toggle. I've toggled it until it says "Not stored on disk" but I can't find how to get it to "Not at all".

After performing that action I tried to toggle off Mask Generated Password with Asterisks, for example, and it prompts me for my Master Password. According to you statement above "I can use whatever I want" so I try any old thing. Nothing works except for my Master Password recently decrypted so I'm perplexed by your statement.

If you only use one, and are ok with the risk of storing it on disk (someone else with physical access to your PC could discover your Master Password the same way you just did)

Remember... the ability to store it is for convenience only, and really is NOT recommended, since it is a security risk.

I live alone and my computers and disks are fairly locked up. I'm not concerned.

[tanstaafl]

As I said there are two masterPassword/masterPasswordKeys in my .rdf files. When I tried the second one it worked! Hmmm... An older password for sure.

Are you sure? There should be only one in the 'globalSettings' section of the RDF file... if there is more than one, something is definitely awry...

Right. There's only one in the globalSettings section of the RDF file. But there is another in my RDF file associated with the upload/download section. You see I run my own server and I decided to set up an area to upload PasswordMaker stuff too. That masterPassword and masterPasswordKey doesn't work with this new decrypt web page. Is the encryption different?

Thats a question for Eric... I gave up trying to do this with PWM, I use a different backup program to sync my RDF file...

Now how to I change it?

It sounds like you still aren't crystal clear on how this works...

You don't change it... just make a note of it so you don't forget it again, then change the 'Store Master Password' option to 'Not at all' - this will delete the saved one from the RDF file, and now you can use whatever you want when prompted.

It's that last portion, "now you can use whatever you want when prompted", that's still not working for me. Let's be clear. I don't see a "Store Master Password" option at all. I do see a "Master Password"  and "Master Password Hash" sections in the PasswordMaker Advanced Options dialog box but no "Store Master Password" option.

Then something is seriously fubar'd...

The 'Store Master Password' option is a select box option below/between the 'Master Password' text entry box and the 'Using Text' text box...

Do you see the 'Using Text' text box? This one is immediately above the 'Master Password Hash' section.

The closest thing is under Master Password Hash it says "Status of Global Hash", its status and a button to toggle. I've toggled it until it says "Not stored on disk" but I can't find how to get it to "Not at all".

Not surprising, since this is not the option I am talking about... it is behaving as advertised...

All that does is store a hash of the MPW for visually confirming whether the hash of the MPW you typed matches the hash of the one you stored (which would mean that you typed the correct Master Password).

After performing that action I tried to toggle off Mask Generated Password with Asterisks, for example, and it prompts me for my Master Password. According to you statement above "I can use whatever I want" so I try any old thing. Nothing works except for my Master Password recently decrypted so I'm perplexed by your statement.

If you really cannot see the 'Store Master Password [select box here]', the I am not surprised by your confusion. As I said, if it really isn't there, something is seriously messed up.

[Eric H. Jung]

I think he's looking in the wrong drop-down listbox. defaria, do you see the attached screenshot?

[tanstaafl]

Thanks eric - I meant to go back and edit my post and attach a screenshot, but its been a busy morning...