Primate Brow Flash

Three times in as many days, I’ve wanted to recover a forgotten password. Two of these were for websites and the passwords were still stored in a browser (one in Firefox, one in Safari) and one encrypted in a htpasswd file on a server. I have learned a number of things about password storage and password recovery tools in recovering these passwords. Chiefly, it told me that anyone with access to my computer can get these passwords, especially the ones hidden by stars in the browser window like this:

Here is a list, in order of increasing difficulty, of ways to find your own passwords

1. The Firefox password was easiest to recover. I’m not happy that Firefox, by default, stores passwords in plain text. If you have Firefox, all you do is go to Tools–> options–> privacy and click the password tab. If you click the show passwords button, you will see all your saved passwords. See Securing Firefox Passwords for information about how to correct this. Firefox passwords are also stored in an encrypted form in C:\Documents and Settings\username\Application Data\Mozilla\Firefox\Profiles\xxxxxxx.default
2. for Safari on a Mac, go to applications –> Utilities –> Keychain Access, enter part of the website’s address into the search field. Double-click one of the results, click “Show password”, enter Admin password and you will see your password for that site. Beats the hell out of calling the bank.
3. stored in Internet Explorer. IE stores these auto-complete passwords encrypted in the registry. The Internet Explorer developer’s toolbar does not reveal passwords hidden by dots. The Firefox Web Developer Toolbar does. So does the DOM inspector. ( but not if you set the master password!) There are several tools available that say they recover Internet Explorer passwords. I tried the free IEPassView and found it showed me all of my passwords for autocomplete forms and any realm authentications I have done.
4. Brute Force Password Recovery Tool. This afternoon, I ran John The Ripper against a htpasswd file containing an encrypted password of mine from a year ago. It took nearly two hours, but it returned the password (8 alpha-numeric characters). It works by trying every possible sequence of characters and encrypting each one to see if it matches the string in the file. It is very simple to install and use. In fact, I just typed the following command and it was off and running:
   john htpasswd. This should destroy the myth that breaking an encrypted password or requires any special skill.
5. RainbowCrack. Haven’t tried this one yet, but it is another brute force approach. This tool generates all the possible string-encrypted string pairs and saving them in big tables known as rainbow tables. When I have an encrypted password to recover, it is just a matter of doing a search across all those huge tables for the encrypted string. This supposed to be much faster than John the Ripper.

This entry was posted on Tuesday, October 24th, 2006 at 1:05 am and is filed under General, firefox, security. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.