Author Topic: help I'm locked out of my email account  (Read 787916 times)

Offline tanstaafl

  • God Member
  • ******
  • Posts: 1363
help I'm locked out of my email account
« Reply #15 on: October 08, 2005, 02:00:38 AM »
Hi redface,

I'm trying to track down this problem for Eric, and hope you will let me work with you on finding out whats going on. I actually think it may be a weird bug in PasswordMaker that only rears its ugly head under certain specific circumstances, so we may have to try a number of things to isolate it.

First, please try the following...

Get your test yahoo account ready (new non-PM password set up), then change it to a PM password using the method documented here. Just use the PM Defaults for now. Change the Encryption settings to whatever you were using in the Account you specifically set up, but document what these are. Be sure your username is correct, and do *not* put anything in the 'When URL Contains' fields for now.

Next, try to log in using PM, experimenting with the following 4 ways of populating the Password field, and see if you can come up with one or more that work consistently. I have a feeling that after you change the password using PM, one of these ways will work consistently, but I'd like independant verification...:

1. right-click in field > populate with PM

2. Alt-`

3. Enable Auto-Populate and refresh the login screen

4. Select the Password that is displayed on the Account Settings (open PM by either Tools > PasswordMaker, or Ctrl-`) (you can highlight/copy it, even though it is not in an editable field).

Please let me know your results... and thanks in advance for your help!

Offline tanstaafl

  • God Member
  • ******
  • Posts: 1363
help I'm locked out of my email account
« Reply #16 on: October 08, 2005, 02:02:41 AM »
Quote
Under the Accounts tab I set up a new Group, and then set up my first account. In the "when URL contains" box I put the base 2nd level domain, and in the "use this URL" box I put the full domain.
Just for clarity, would you mind specifying the *precise* text you put in these two fields?

Was it:

mail.yahoo.com   /   yahoo.com?

Thanks

redface

  • Guest
help I'm locked out of my email account
« Reply #17 on: October 10, 2005, 05:47:55 PM »
Hi tanstaafl,

Thanks for offering to work me through this problem.  :)

I'll try the things you've set out. In the meantime, the answer to your question is:

In the "when URL contains" box is "deckertechnology.net"
In the "use this URL" box is "http://deckertechnology.net"

Offline tanstaafl

  • God Member
  • ******
  • Posts: 1363
help I'm locked out of my email account
« Reply #18 on: October 10, 2005, 06:10:47 PM »
Quote
In the "when URL contains" box is "deckertechnology.net"
In the "use this URL" box is "http://deckertechnology.net"
Ok, just fyi, there is a security issue that has been discussed here, which details why this is almost backwards from the way you should use these fields.

In this particular case, the most secure way would be:

When URL contains: /deckertechnology.net/ <- note the trailing slash
Use this URL: deckertechnology.net

I guess this is a good example of a potential issue using the technique described in the above thread that I use:

.domain.com/

If you use this now, and go to a URL that doesn not have the www. preceding the top-level domain name, then it would consider that NOT a match.

What I'm hoping to convince Eric to do is code this so that it recognizes a true sub-domain and/or sub-directory from a fake, automatically. So, in effect, all you'd have to enter in the first field is 'deckertechnology.net', and PM would evaluate it thusly:

*[.]deckertechnology.net[/]*

where the preceding '.' (dot) is the only character allowed (but not required) to immediately precede what is entered, and the trailing '/' (slash) is the only character allowed (but not required) to follow the last character entered, and the asterisks are, of course, wildcards (anything).

Anyway, the thread makes good reading to understand just how these fields are used, and how their behavior may possibly change (for the better).

Guest

  • Guest
help I'm locked out of my email account
« Reply #19 on: October 10, 2005, 06:49:05 PM »
tanstaafl,

Thanks for the info. I understand the better security of adding the [.] and [/].

I haven't been able to get PM to log me in accurately yet.  :(

- Right click/populate "worked", but was an "incorrect login".
- Alt-' just beeped at me.
- Auto-populate/refresh did nothing.
- Copy/paste the displayed password resulted in same as right click/populate.

Offline Eric H. Jung

  • grimholtz
  • Administrator
  • *****
  • Posts: 3353
help I'm locked out of my email account
« Reply #20 on: October 10, 2005, 06:56:39 PM »
Have you read quixin's new post here? I'm betting it applies to you...

Offline tanstaafl

  • God Member
  • ******
  • Posts: 1363
help I'm locked out of my email account
« Reply #21 on: October 10, 2005, 07:05:16 PM »
Quote
I haven't been able to get PM to log me in accurately yet. sad.gif

- Right click/populate "worked", but was an "incorrect login".
- Alt-' just beeped at me.
This is important:
What OS (Windows? Linux?)?
What version (Windows 2000? 98? XP?)

It should not just 'beep' at you... or are you hitting three keys instead of just the two (ALT and ')?

Quote
- Auto-populate/refresh did nothing.
? You mean, when you refresh the login window, with Auto-populate enabled, you do not get the Master Password Prompt window?

Quote
- Copy/paste the displayed password resulted in same as right click/populate.
Ok, I'm curious to see if quixins post sheds some light on this for you - if it doesn't, I'll go create an account there and try it myself... I would have done it already but I just got slammed this weekend and today - I really shouldn't even be posting this message...

redface

  • Guest
help I'm locked out of my email account
« Reply #22 on: October 10, 2005, 09:24:23 PM »
Quote
quixin's new post
I'm thinking this is real close to home. The answer's gotta be in the URL, but I'm just not seeing it...

After deleting the existing PM account for the page, I went back to the login page, carefully determining the EXACT address. Then I set up a new PM account and password. Then I went to the "change password" page, which is on a different URL. I changed the password using the password which I had generated on the actual login page. Then I logged out and returned to the login page (matching up the exact URL with the one used to set up the password), where I got an "incorrect login" message.

I use WinXP Pro. And I just hit Alt and ' - nothing else. But I had already changed that function from whatever the default is. I won't remember that function in the long term, so I turned it off. I turned it back on before trying your suggestion (I set it on "populate empty fields only").

As soon as I type in a user name, it changes the password, even before I enable auto populate! And what about the box called "modifier" - how does that relate to all this?

Guest

  • Guest
help I'm locked out of my email account
« Reply #23 on: October 10, 2005, 09:37:05 PM »
I have also tried having PM use the exact URL of the actual page where I changed the password. Still incorrect.

Offline quixin

  • Hero Member
  • *****
  • Posts: 538
help I'm locked out of my email account
« Reply #24 on: October 10, 2005, 10:32:59 PM »
redface,  Do you have a high speed connection?  I'm going to do a video that shows the processs of setting up an account and then logging into it.  If your on a high-speed connection I will just provide a link to the video.



Guest

  • Guest
help I'm locked out of my email account
« Reply #25 on: October 10, 2005, 10:40:32 PM »
We are on low-end broadband here - a link will be fine. :)

Offline Eric H. Jung

  • grimholtz
  • Administrator
  • *****
  • Posts: 3353
help I'm locked out of my email account
« Reply #26 on: October 10, 2005, 11:29:33 PM »
Quote
As soon as I type in a user name, it changes the password, even before I enable auto populate!
The username field affects the password so that if you have two accounts on the same site (e.g., redface1 and redface2 on gmail.com), then you can generate different passwords for each.

Quote
And what about the box called "modifier" - how does that relate to all this?
This field is completely optional. All it does is change the generated password. One of its values is for sites which expire passwords, requiring you to change them periodically. You can leave all other settings alone but change this "modifier" field to create a new generated password.

redface

  • Guest
help I'm locked out of my email account
« Reply #27 on: October 10, 2005, 11:41:49 PM »
re:
Quote
The username field affects the password so that if you have two accounts on the same site (e.g., redface1 and redface2 on gmail.com), then you can generate different passwords for each.

I was trying to follow the directions to #3 below:
Quote
Next, try to log in using PM, experimenting with the following 4 ways of populating the Password field, and see if you can come up with one or more that work consistently. I have a feeling that after you change the password using PM, one of these ways will work consistently, but I'd like independant verification...:

1. right-click in field > populate with PM

2. Alt-`

3. Enable Auto-Populate and refresh the login screen

So if I understand correctly, if I choose to auto populate, I have to set up a whole new password w/PM to test this theory...

Offline quixin

  • Hero Member
  • *****
  • Posts: 538
help I'm locked out of my email account
« Reply #28 on: October 11, 2005, 12:01:08 AM »
redface, I think its better not to worry about the auto-populate yet.  Lets first get acquainted with the basics.  The following link will provide you with a quick video that shows changing your password on deckertechnology.net".  I'm hoping you recognize the screen once you see it.  I didn't show the login sequence, just the page where you change your password.  After I create an account in passwordmaker I also show how to login to the account using PasswordMaker.

http://www.savefile.com/files/8782719
I hope you have the codec to view that avi.

Hopefully those steps show you how to do the same with your own settings.  Give us an update once you try it.

Quote
Quote
And what about the box called "modifier" - how does that relate to all this?

This field is completely optional. All it does is change the generated password. One of its values is for sites which expire passwords, requiring you to change them periodically. You can leave all other settings alone but change this "modifier" field to create a new generated password.

I asked Eric this some time ago when it was the counter and he gave a much longer explanation (back when he had a little more free time and a shorter request list)  You can find that here.

Good Luck.
« Last Edit: October 11, 2005, 12:07:45 AM by quixin »



Offline Eric H. Jung

  • grimholtz
  • Administrator
  • *****
  • Posts: 3353
help I'm locked out of my email account
« Reply #29 on: October 11, 2005, 12:15:13 AM »
quixin, thanks for the awesome demo! dunno if it's just my rig here, but the video is extremely blurry. Hope it's just me. Tried to do a screenshot, but HoverSnap doesn't seem to like video overlays...

PasswordMaker Forums

help I'm locked out of my email account
« Reply #29 on: October 11, 2005, 12:15:13 AM »