The master password has been designed to protect the saved password listing from other users. It basically means that the password needs to be entered before the listing can be accessed for the first time protecting the user’s saved login information.

The master password needs to be entered only once during a Firefox session (that’s the time from opening the browser until it is closed again) which leads to further difficulties. Anyone can access the password list again once the master password has been supplied with no apparent option to lock the browser again other than to close it.

Master Password+ has been designed to improve the master password feature of the Firefox web browser and Thunderbird email client. It adds a set of features to the master password to make it more secure. Among the options is a timeout feature which can be set to reset the master password flag so that it needs to be entered again after a certain time. It is furthermore possible to lock and unlock the master password with the hotkey Alt-L.

The master password prompt can also be launched during browser start so that the profile can only be used if it is entered correctly by the user. Master Password+ improves the security if the master password is being used in Firefox. The master password itself on the other hand does not offer 100% protection. The add-on is available for Firefox 3 and 4 as well as the Thunderbird email client.

We reviewed FireMaster back in 2007. The principle to recover the Firefox master password has remained the same but the options to recover it have been improved. FireMaster is compatible with the latest version of the Firefox web browser. It uses brute force, dictionary attacks or a hybrid of both methods to recover the Firefox master password.

The command line tool requires the key3.db file which stores the master password information. The tool uses the following method to recover the password.

• FireMaster generates passwords on the fly through various methods.
• Then it computes the hash of the password using known algorithm.
• Next this password hash is used to decrypt the encrypted data for known plain text (i.e. “password-check”).
• Now if the decrypted string matches with the known plain text (i.e. “password-check”) then the generated password is the master password.

The success rate of the available methods depends largely on the Firefox master password. One interesting feature is the ability to specify known parts of the password in the command line argument.

FireMaster.exe -b -c "abyz" -l 12 -p "fire?????123" c:\testpath

This command above will perform a brute force crack using the character set abyz. The minimum password length has been set to 12 in this example and the password begins with fire and ends with 123. The path at the end points to the key3.db file that contains the master password information.

Firemaster is compatible with all official versions of Firefox and runs on Windows operating systems.

RoboForm is available for Microsoft Windows operating systems and can be installed directly, on a USB device or on mobile devices such as Windows Mobile, Symbian or Blackberry. The software integrates nicely with web browsers like Firefox, Internet Explorer or AOL / MSN and displays a toolbar that provides access to all the application’s functions and there is also a System Tray icon providing the same.

The password manager will automatically catch data that is entered in password forms and provides the means to store those passwords in the application so that it can be used to automatically log into the website or service.

Information are stored in so called passcards which do not only contain information like the username or password but additional parameters like cookie length or emails. The information can be protected with a master password which is similar to the feature of the same name in Firefox. The data is therefor protected and save from prying eyes until the master password is provided.

Keyboard shortcuts speed up the process further by providing access to some of the functions and menus. The password manager is only one of the features of RoboForm. It will also aid the user during registration.

It is not a problem to use very long and secure passwords since all passwords are stored in the application. The password generator helps the user by generating a secure password for the website or service.

It provides options to select the length of the password, the allowed characters and the minimum amount of numbers. The password generator will also display the bit strength of the password to give the user an indication of the strength.

Passwords are only one type of information that have to be provided during registration. RoboForm makes use of so called identities that can be used to fill in the other information automatically as well. Identities are data sets that contain information such as names, email addresses, phone numbers and any other type of data the user likes to add.

These information can then be used to automatically fill a registration form which can be a huge time saver for users who regularly sign up for new services on the Internet. Different identities are available to distinguish different users or different environments such as work and home.

Another useful feature of RoboForm is the note taking module. It can be used to store notes securely on the computer. Notes can also be protected by the master password so that no one can access them without providing the master password first. Notes are simple text documents that contain information saved by the user.

RoboForm is an interesting application for users who spend a lot of time on the Internet. If you ever had to register to 20+ services on a day you know how much time it takes to fill out all the information over and over again. Using RoboForm this could have been done in a fraction of the time since the data would have to be entered only once by the user.

We got five RoboForm Pro licenses. If you want one leave a comment below.

The Opera Password Manager on the other hand is only protecting the data from being entered automatically if it has been set this way. There is no obvious way to look at the usernames and passwords that have been stored in Opera. Tamil over at Opera did post a workaround for that problem.

So the major problem if the Master Password in Opera has been forgotten is that Opera will not fill out the username and password of sites that have been stored in Opera.

Tamil comes again to the rescue by providing a guideline on how to reset the master password in Opera.

If Tools → Preferences… → Advanced → Security → Use master password to protect saved passwords is not enabled, delete opcert6.dat from profile after closing Opera.

If Tools → Preferences… → Advanced → Security → Use master password to protect saved passwords is enabled, delete/rename opcert6.dat & wand.dat from profile after closing Opera.

The process does involve deleting (or renaming) files in the Opera profile directory (located in Documetns & Settings by default). The file opcert6.dat has to be always deleted or renamed while wand.dat only needs to be removed if the option Use master password to protect saved passwords is enabled in Opera.

Please note that deleting wand.dat will remove all stored passwords from Opera Wand.

The user who has forgotten his master password has basically only the choice to reset the password which unfortunately means that all login details will be lost in the process. The only other way that could bring a result would be a brute force attack. The success of the latter method depends on the password that you have chosen during setup of the master password.

Brute Force will most likely succeed if the master password consists of a existing word, words or names. It will not succeed in reasonable time if the user entered a random password with letters and numbers.

Reseting the Master Password in Firefox:

Open Firefox and paste the following line into the address bar:

chrome://pippki/content/resetpassword.xul

A text will appear saying that if you reset your master password all login details including usernames, passwords and websites will be lost. If you click on Reset the master password is reset which means that you can enter a new one. Cancel would be the other option.

Brute Force the Master Password in Firefox:

You can use a software called FireMaster to try and use the Brute Force method to regain your Master Password.

* FireMaster generates passwords on the fly through various methods.
* Then it computes the hash of the password using known algorithm.
* Next this password hash is used to decrypt the encrypted data for known plain text (i.e. “password-check”).
* Now if the decrypted string matches with the known plain text (i.e. “password-check”) then the generated password is the master password.

I would only use the brute force method if you are nearly certain that you used a word or word combination. A password like ‘X23n52fF:tht0_ete%v5′ would take ages to reveal.

Read More:

FireMaster