Passwords stored by Firefox

[g]

On 02/15/2015 06:16 AM, Patrick O'Callaghan wrote:
<>

> On Sun, 2015-02-15 at 22:07 +1030, Tim wrote:
<>

a few years ago, i would have agreed with you both.

except for, a few years ago +1 day, when i needed to find password
for a client running w98se, that had an employee leave. he actually
was fired and when asked for his password, he supplied wrong password.

granted, with w98se, such was not a great problem, except that he
had also encrypted a lot of files.

on a hunch, to see if he used same password for encrypted files, i
ran a web search to see what was available to recover his password,
and i found: Austrumi 0.9.2 iso and burned it to a cd.

  http://cyti.latgola.lv/ruuni/
  ftp://austrumi.ru.lv/

  https://en.wikipedia.org/wiki/Austrumi_Linux
  http://distrowatch.com/table.php?distribution=austrumi

on boot, it presents a list of options, among them is password
recovery for oos, which i ran and recovered his password. after
login, i found encryption program he used, ran it using his login
password and obtained access to files.

the next day, i decided to install w98se on a spare drive and run some
test to see how well it worked. i did notice a little increase in time
with larger passwords, but i did not use a stop watch to time them.
"counting monkeys" was close enough. ;-)

i have not had need again and i do not know how Austrumi works on
latest releases, or even if it does.

i do know that there are many programs for cracking encrypted files
and phrases, and i have noted that some have comments regarding the
make up.

i see no need to debate what does or does not make good passwords,
ie, longer to to break or unbreakable, because there are plenty of
decrypt programs for linux that you can see for yourself that the
more mixed, the harder/longer to decrypt. if you live long enough. ;-)


-- 

peace out.

in a world with out fences, who needs gates.

CentOS GNU/Linux 6.6

tc,hago.

g
.