gHacks technology news » firefox master password http://www.ghacks.net A technology blog covering software, mobile phones, gadgets, security, the Internet and other relevant areas. Wed, 25 Nov 2009 15:55:11 +0000 http://wordpress.org/?v=2.8.6 en hourly 1 Recover Firefox Master Password With FireMaster http://www.ghacks.net/2009/08/27/recover-firefox-master-password-with-firemaster/ http://www.ghacks.net/2009/08/27/recover-firefox-master-password-with-firemaster/#comments Thu, 27 Aug 2009 10:46:45 +0000 Martin http://www.ghacks.net/?p=15777 firefoxThe Firefox Master Password is a security option in the Firefox web browser that password protects saved login information in the web browser. These login information can be accessed directly in the web browser if no master password has been set.

We reviewed FireMaster back in 2007. The principle to recover the Firefox master password has remained the same but the options to recover it have been improved. FireMaster is compatible with the latest version of the Firefox web browser. It uses brute force, dictionary attacks or a hybrid of both methods to recover the Firefox master password.

The command line tool requires the key3.db file which stores the master password information. The tool uses the following method to recover the password.

  • FireMaster generates passwords on the fly through various methods.
  • Then it computes the hash of the password using known algorithm.
  • Next this password hash is used to decrypt the encrypted data for known plain text (i.e. “password-check”).
  • Now if the decrypted string matches with the known plain text (i.e. “password-check”) then the generated password is the master password.

The success rate of the available methods depends largely on the Firefox master password. One interesting feature is the ability to specify known parts of the password in the command line argument.

FireMaster.exe -b -c "abyz" -l 12 -p "fire?????123" c:\testpath

This command above will perform a brute force crack using the character set abyz. The minimum password length has been set to 12 in this example and the password begins with fire and ends with 123. The path at the end points to the key3.db file that contains the master password information.

Firemaster is compatible with all official versions of Firefox and runs on Windows operating systems.

Tags: , , , , ,

Related posts

]]> http://www.ghacks.net/2009/08/27/recover-firefox-master-password-with-firemaster/feed/ 2 Firefox Mass Password Reset http://www.ghacks.net/2008/11/26/firefox-mass-password-reset/ http://www.ghacks.net/2008/11/26/firefox-mass-password-reset/#comments Wed, 26 Nov 2008 10:14:22 +0000 Martin http://www.ghacks.net/?p=8499 It is a common among security professionals to use a password only once. Many Internet users on the other hand prefer to select the same username and password on all websites that they create accounts for to make it easier to access those websites. Having to remember only one password is easier than having to remember several.

Tools have been created that can generate and store unique strong passwords so that the user does not have to remember anything anymore. These tools are unfortunately not used by many Internet users. (Last Pass is one alternative).

The problem with having the same account data for multiple websites is that one breach is enough to put all accounts in jeopardy.

Mass Password Reset is a Firefox add-on that can change the password of multiple accounts in Firefox in one go. This is useful if you decided to change the password for a username that you are using on multiple websites.

The tool can change the password based on a the domain, username or password. You could use the tool to change passwords of all accounts associated with the domain ghacks.net, with the username ghacks or the password ghacks1. (No that is not the admin pass here .P)

The main benefit of using Mass Password Reset is that it can quickly change a lot of passwords in one go. It is however advised to use a password manager or a system of unique username and password combinations for every account instead.

Firefox is preventing access to the add-on if a Master Password has been set in the web browser. The Master Password has to be entered before any passwords can be changed.

Tags: , , , , , , ,

Related posts

]]> http://www.ghacks.net/2008/11/26/firefox-mass-password-reset/feed/ 4 Make sure you set a master password in Firefox http://www.ghacks.net/2007/10/02/make-sure-you-set-a-master-password-in-firefox/ http://www.ghacks.net/2007/10/02/make-sure-you-set-a-master-password-in-firefox/#comments Tue, 02 Oct 2007 15:21:05 +0000 Martin http://www.ghacks.net/2007/10/02/make-sure-you-set-a-master-password-in-firefox/ I can’t stress the importance of the master password in Firefox if you are one of the users who is letting Firefox save passwords for you so that you do not need to enter the password and username again when visiting the site at a later time. While this feature is surely comfortable and takes away the need to memorize usernames, passwords and corresponding sites plus the typing that has to be done when logging into a site it is a security risk.

Even more so if you have not set the master password. Anyone with access to your computer is able to go into Tools > Options and click on Show Passwords under the Security tab. What this does is that it lists all sites and usernames that Firefox has stored in its database.

Pressing the button ‘Show passwords’ in that new menu displays all corresponding passwords for all sites. Gmail, Blogs, Myspace, nothing is really safe. By taking a look at your passwords someone could also analyze patterns. If you were using the same passwords on all sites it is fairly easy to assume that your pop3 email account would most likely use the same password.

firefox master password

So, set your master password to be on the safe side here.

Tags: , ,

Related posts

]]> http://www.ghacks.net/2007/10/02/make-sure-you-set-a-master-password-in-firefox/feed/ 10