We reviewed FireMaster back in 2007. The principle to recover the Firefox master password has remained the same but the options to recover it have been improved. FireMaster is compatible with the latest version of the Firefox web browser. It uses brute force, dictionary attacks or a hybrid of both methods to recover the Firefox master password.

The command line tool requires the key3.db file which stores the master password information. The tool uses the following method to recover the password.

• FireMaster generates passwords on the fly through various methods.
• Then it computes the hash of the password using known algorithm.
• Next this password hash is used to decrypt the encrypted data for known plain text (i.e. “password-check”).
• Now if the decrypted string matches with the known plain text (i.e. “password-check”) then the generated password is the master password.

The success rate of the available methods depends largely on the Firefox master password. One interesting feature is the ability to specify known parts of the password in the command line argument.

FireMaster.exe -b -c "abyz" -l 12 -p "fire?????123" c:\testpath

This command above will perform a brute force crack using the character set abyz. The minimum password length has been set to 12 in this example and the password begins with fire and ends with 123. The path at the end points to the key3.db file that contains the master password information.

Firemaster is compatible with all official versions of Firefox and runs on Windows operating systems.

Tools have been created that can generate and store unique strong passwords so that the user does not have to remember anything anymore. These tools are unfortunately not used by many Internet users. (Last Pass is one alternative).

The problem with having the same account data for multiple websites is that one breach is enough to put all accounts in jeopardy.

Mass Password Reset is a Firefox add-on that can change the password of multiple accounts in Firefox in one go. This is useful if you decided to change the password for a username that you are using on multiple websites.

The tool can change the password based on a the domain, username or password. You could use the tool to change passwords of all accounts associated with the domain ghacks.net, with the username ghacks or the password ghacks1. (No that is not the admin pass here .P)

The main benefit of using Mass Password Reset is that it can quickly change a lot of passwords in one go. It is however advised to use a password manager or a system of unique username and password combinations for every account instead.

Firefox is preventing access to the add-on if a Master Password has been set in the web browser. The Master Password has to be entered before any passwords can be changed.

Even more so if you have not set the master password. Anyone with access to your computer is able to go into Tools > Options and click on Show Passwords under the Security tab. What this does is that it lists all sites and usernames that Firefox has stored in its database.

Pressing the button ‘Show passwords’ in that new menu displays all corresponding passwords for all sites. Gmail, Blogs, Myspace, nothing is really safe. By taking a look at your passwords someone could also analyze patterns. If you were using the same passwords on all sites it is fairly easy to assume that your pop3 email account would most likely use the same password.

So, set your master password to be on the safe side here.