Browsers: don't worry, we encrypt all of your passwords to keep them safe! Also browsers: we store the encryption key right beside your passwords!

@Luna5829

Жыл бұрын

i mean no matter where you store it people can just find it and look for it inside of their script

@retzerR

Жыл бұрын

@@Luna5829 Encryption keys be generated from text, so in reality the can store locally with a password as the encryption key. Also when the browser is online it can use the browsers company servers, so no need to use a local copy in that scenario anyway.

@iamlorddems3859

Жыл бұрын

For your convenience of course

@jmr

Жыл бұрын

@@retzerR Can you imagine how ticked someone would be if the internet went down and their ISP asked them to log in to their router but the browser stored the encryption keys exclusively in the cloud? I don't think any do that.

@retzerR

Жыл бұрын

@@jmr Good point, but they can also be stored locally, just with a password used to generate the encryption key, which is never stored. At least then the password will have to be brute forced, or social engineered

Moral of the story don't save passwords in the browser, awesome video John love your content.

John, you explain in a way that is very understandable something so many people dont have the time/skills to do.I enjoy not only watching your vodeos but also just listening as you explain thoroughly i can almost visualise what you are doing.I hope you get to where you deserve to be pal !!!

...and this is WHY scam-baiters are constantly telling ppl to NOT store passwords in the browser! Awesome vid John!

@JeremyPatMartin

Жыл бұрын

This is why you use hardware encryption keys, or other 2fa for everything, including browser based password systems

@TTTT-sj3vz

4 ай бұрын

@@JeremyPatMartin what do you recommend? I want to have a hardware kinda thing to store my passwords , thank you

Always informative

So I have to leave the comment to let you know that you've helped so much. True could have happened with any video but just happened to hit yours first. My uncle passed away a week or so ago and he had a lot of cherished memories stored in his phone and laptop, I've learned to get through the windows password the pash couple of days probably through the least direct wya but this helped me to guess what his phone password was and get the remaining memories. Thank you for making the video and helping me recover the cherished memories.

What detection rules would you recommend for such cases ? Any specific eventid or something ?

Passbolt (and any other password manager) employs the similar mechanisms for storing and sharing passwords as your browser password manager, it just has a robust feature set for sharing the password with others. Don't get lazy and believe any password manager is a golden bullet. Passwords are stored using a cipher, which will take a long time to break if you were to brute force it, but the key to the cipher needs to be kept on your local machine in order to access them. The best way to protect yourself is to use multiple layers of authentication. 2FA authenticator applications, NFC tags, biometrics. Separate storage or data mediums that can have a hash created, so only the medium itself is a way to authenticate. Employ good practice and having multiple layers of security is the best way to keep you and your data protected.

@PSADS-qb5im

Ай бұрын

I commented before your last paragraph then realised it said the same thing 😂

Awesome content and very informative! 🙌

is the masterpassword on firefox an easiest solution ? doesn't use the masterpw to encrypt ? thank you in advise

Ur awesome, I'm so happy I found a video of something so hard to learn, I had already given up thinking that I wouldn't be able to find information on how to decrypt my browser passwords, thanks!

I was actually intrigued when i saw passbolt sponsor this video, cause i switched to them from lastpass about 3 months ago..honestly yes, best pw manager i can say

I really appreciate your content it is really helpful. And is there any way of decrypting those chrome passwords on another machine?

I've yet to see a "password manager" that I feel entirely comfortable with. Ultimately your passwords have to be stored on something physical. Even if in encrypted form, they're only as good as the encryption key/password used to encrypt them. And how do you store that? You're down to memory versus sticky notes, and master passwords are a vulnerability in themselves. Thoughts?

I'd love to see some timelines on your videos John! :)

What about On-device encryption: On-device encryption applies to your passwords and passkeys only. Sync passphrase applies to all of the data that you sync to Google via Chrome. Or attaching a google account to the password manager, would this make a difference?

I will gladly follow along, thanks for the invitation, John!

Nice and thanks for sharing. What is the impact / possibility if the encryption key of the local password storage is "protected" by a master password (Let's assume it is complex or is a long-assed pass phrase) would that be a mitigation for local storage attacks?

Almost any password vault is vulnerable to local attacks. Unless you're typing something in when you go to log into a website, there's a guaranteed way to retrieve that password if you have local access. Even if you have to go to the website and wait for the tool to fill in the password field, you can get it once the password field is filled out in the browser with a trivial console command.

@cpcp-qx5bl

Жыл бұрын

To be honest on most sites you can just copy paste the password from the password field of the website into any text field.

@AiSponge2

4 ай бұрын

@@UNagano589 🤣😂😂

There are utilities for 'whatever web-browser you are using'? What about Safari on macOS; I was under the impression that it uses the system keychain for password storage.

What is the passwords are stored in google account ? the login sqlite db will be empty ?

Thanks for this excellent video. After seen it, I wonder how do you know the location and lenght of the initialization vector [3:15]. I did not get where do you obtain it from. Also, how to you know the lenght of the encryted password itself [15:-16]. That was also unclear to me. Once you get those, the rest of the work seems to be pretty straightforward... Thanks again!

Why am I only now hearing about Passbolt? It sounds like something everyone I talk to would talk about.

Internet explorer crying in the corner

@JeremyPatMartin

Жыл бұрын

The weakness looks a LOT like windows instead of chrome. Don't save your chrome passwords locally on a windows machine

@nomkid8880

Жыл бұрын

where it belongs. in the corner. an eternity in the time-out corner.

@wishIKnewHowToLove

Жыл бұрын

😢

@_GhostMiner

11 ай бұрын

Imagine using IE 😂

@Tzhz

11 ай бұрын

​@_GhostMiner Edge is better than chrome, has been for a while.

How to do this one a userdata file from a user that is not the current user?

I have a question if we use metaspoit and get the password login file of chrome how can we decrypt them locally I couldn't find anything about it

Great video John but could you help me real quick? I tried following along but got the following errors when I initiated the final decryption step: “CryptUnprotectData”, “Key not valid for use in specified state” and “Chrome secretkey cannot be found” . Please help. Thanks

Nice John :D

I learned this a long time ago. You can very easily make a vba macro that can email you all of someone's Chrome passwords in clear text.

@gabrielleg7040

8 күн бұрын

How sir ?

Is possibile to decrypt another login data file or only that one from your pc?

Thank you JH 🙏

awesome info John, is this pretty much the same file location on macos and linux?

@webofchaos2684

Жыл бұрын

OSX location = /Library/Application Support/Google/Chrome/Profile/Login Data Linux = /home/{user}/.config/google-chrome/Default/Login Data Encryption key stored differently as well.

Your sponsor is awesome 🤩

Makes me wonder why they don't encrypt the storage with your account password and if you have a sync password salt it with that.

How do you secure your passwords ? ( actually not "comercial" because they support you ) :)

not just saved passwords, we can easily access logged in sessions using cookies. if u get system u get everything

Amazing video🎉

Careful, I remember there was some algorithm that can decrypt pixelated censor and it is really good at it, hope you changed your other user password after this

@nogaxeh6

Жыл бұрын

You're right in some contexts, but it needs more precision; you can undo many blurring effects and you can undo some pixelated censors. The vulnerable pixelated censors are the ones using many pixels to censor the content, king of like a pixelated "low res blur effect", so to speak. In this context, the one John is using uses whole squares, which does not seem to leak info from under, so I'd reckon it is not vulnerable to that attack vector. I personally would censor using a plain color bar, as it is never affected by that attack.

@blablubb1234

Жыл бұрын

Wasn’t it also just brute-forcing instead of decrypting? Think of the pixelated blur as something like a one-way hash function: blurring the same text results in the same pixel values, but reversing is hard.

@kipchickensout

Жыл бұрын

@@blablubb1234 imagine a two-way hash function

@andrewe4240

Жыл бұрын

Depix, for example, if I remember correctly. But yeah, unlikely tp work here.

@ChrisWijtmans

Жыл бұрын

that only works with shitty pixelated censoring.

Does this also apply to the gnome keyring? Because I don’t use Windoze as a desktop…. I don’t think anything is secure on that platform anyway. I know that the gnome keyring gets unlocked on during login, however, that is different than being available from the file system…

@JustPlayerDE

Жыл бұрын

software that wants access to the keyring always has to ask for permission from the user first (at least the first time) even if it is unlocked afaik

So what's the point for Chrome to encrypt it anyway since it's all like as if it just stored it in plaintext on the local machine?

@jdspecht682

Жыл бұрын

Encrypting makes it slightly more difficult to steal the data rather than storing it directly in plaintext in a file.

And thats why I dont save passwords anywhere. I have a password algorithm in my head that creates a random string pass, upper/lower case, numbers, etc for each site. Don't need to remember them that way. If it ends up on a hacked password dump, it won't work on any other site and looks like a long random string.

This is why it's important to secure your OS login! For the convenience that the browser's password manager offers, like those on your phone, you have to ensure your OS login is secure and to not leave it unlocked. Treat it like you would your phone. Of course, this assumes other users of the device aren't admins. And I do think Chrome should find a way to avoid storing the cryptographic key in the cloud and off the local device, even if that requires re-authenticating with Google every time you launch your browser - it should at least be an option.

@Aera223

Жыл бұрын

That will work up to a point; with a Live OS, anything unencrypted on the disk can be read. BitLocker / Password protected browsers can help though.

Thanks dude!

A easier solution is to go to the website of the stored password, let it auto fill it, and change the HTML to show the starred contents.

@parkerlreed

11 ай бұрын

I haven't seen this work in quite a long time.

@maximeg3659

11 ай бұрын

​@@parkerlreedI have been successfully using this method for 10 years on chrome, last time was yesterday

@user-gv9sx4qo3w

10 ай бұрын

@@parkerlreed it does still work i think

@itista7

9 ай бұрын

yep, it still does work...

@codermomo1792

3 ай бұрын

What this video can help with is when can pull someone password files to your pc( using powershell script, for example) or when you get a shell access only

If I have access to the computer, i can just go into the password manager of the browser and look at the password in plain text. I dont see the point of this exercise.

Does it actually work if you just grab the files, or does it use DPAPI so it can only be decrypted if the user is currently logged on?

@claudiafischering901

Жыл бұрын

It can be downloaded and than also decrypted on your own machine. Very easily! Do avoid it put a master password - that do a little bit harder to decrypt all your saved passwords. The bad person need first the master password - bruteforce but If you choose a very long Password for that, than it takes years to bruteforce it. But Choose your own password managment system what do you like. 100% Safty is not given in the IT-World.

@jdspecht682

Жыл бұрын

Yes that user needs to be currently logged on.

i want from linux but can do this? good watching we undestand..

hi i have question can you plz answer ? chrome save my Gmail account but i forget my Gmail password now i want to look it up in autofill option but there is no Gmail password mention all other save passwords are available but there is no gmail password is showed what i suppose to do ?

Anyone know what it means to get this error message in command? ‘utf-8’ codec can’t decode byte 0xf6 in position 1: invalid start byte [ERR] Unable to decrypt, Chrome version

@xxissamexx

2 ай бұрын

8:51 Same for me, the exact same- URL, User Name there but Password is blank. It also shows 'utf-8' codec can't decode byte 0xf4 in position 0: invalid continuation byte [ERR] Unable to decrypt, Chrome version

If i accidentally deleted one chrome account , should i see it throught this method ?

Would changing the install location make any difference?

@kipchickensout

Жыл бұрын

I think no matter where you install the browser, that these extra files are always stored in that directory 🤔 and if you changed it they might just scan the whole file system for it

I use Nirsoft WebBrowserPassView I think it does the same job. Is it possible to decrypt browser passwords that are locked by a master password?

@trishulsingh01

Жыл бұрын

How does master password this work?

Doesn’t this only work if the person is currently logged on, on the target machine (which you also need access to)?

Does this work only for chorme or all chromium browsers, apart from that it may be a different location?

@webofchaos2684

Жыл бұрын

script works for all Chromium browsers on windows Chrome,Microsoft Edge,Brave,Opera just need to change browser directory

Trying it out on my own pc but command prompt keeps getting a error saying it can't install win32crypt??

If you still a little slow in keeping up with this guy, like me, it really helps to slow the video down a notch or two in the settings 😢

So the python script grabbed the key from the Local state file to decrypt the db?

@webofchaos2684

Жыл бұрын

python script extracts the encryption_key from Local state json file to decrypt the ciphertext stored in Login Data database. sqlite db is not encrypted.

where do i find SQLITE to read data file from windows?

The "pypiwin32" doesn't install in my macos. As I couldn't able to run this script. Any suggestions to recover it.

How did the chrome decrypter know where to look to decrypt your passwords, did it just "know" to go straight to your locally saved ones or did you direct it there somehow

@webofchaos2684

6 ай бұрын

Default path defined in script: CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE'])) CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data"%(os.environ['USERPROFILE'])) If you need a custom path you can modify it.

“…Or, God forbid, Internet Explorer” 🤣🤣🤣

So getting down into the weeds a bit, how is this script able to just work out of the box? Is the key the same across all installations of Chrome such that the script can just reverse the ciphertext given the IV used? Would love to hear from someone who might know!

@kipchickensout

Жыл бұрын

i mean it can just read out the key right? but the IV as well?

@webofchaos2684

Жыл бұрын

no every encryption key is different. the script reads the local_state file in chrome directory and extracts the encryption_key, then reads the login.sqlite data to extract the ciphertext and the IV that is all that is required to decrypt passwords. Same technique works for credit cards as well.

I cannot imagine how this should work on my Linux (Ubuntu server/openbox/gnome-keyring) machine. The sqlite db 'Login Data' is locked when the browser is open and the passwords encrypted otherwise, of course. There is no way to get to the passwords other than being logged in as me.

How can we access \ get the code shown in the video ? any help anyone ?

I thought this was pssible. Thanks John.

I was looking for this thing.. thanks John

Yeah, totally true. However, the scenario assumes the attacker is running the script with same privileges as the victim. Most malware run with that privileges I suppose, but think it is important to mention.

@cloudbase7799

11 ай бұрын

More accurately, the script needs to run in the same security context as the target user (having local administrator privileges on the same computer is insufficient). Let's say you have/gain physical access to a user's computer, but you can't and/or don't want to sign on as them. Assuming Windows: maybe you don't know/have their Windows password and you don't want to change it to a known password. You boot the system with something like Hiren's and set a password on and enable the built-in administrator account, then boot the computer and sign on with the built-in administrator account. Even after tweaking the script to target the user's (not built-in administrator) Chrome, you will see a message something like, "(-2146893813, 'CryptUnprotectData', 'Key not valid for use in specified state.') [ERR] Chrome secretkey cannot be found."

in windows environments , the encryption keys is located in the "local state" file , that is a huge security risk , in the other hand , in macos environment ,the encryption key in located in the keychain App , so in order to get the encryption key , first you need to unlock the keechain app .

@JuanVillasante

3 ай бұрын

Actually, what he showed is not the real key, but an encrypted key. To get the real key, you can only decrypt it on the same computer using the Windows API CryptUnprotectData

Do you know what version of chrome this works for? Didn’t work for me it did pull all sites and usernames though

@webofchaos2684

6 ай бұрын

Works for browser versions 80+

What if your PC explodes or something? You will probabaly say that you can recover your passwords from another PC, but then you need a password for that, that will access all your passwords, so what's the point?

Odd this stuff doesn't appear in more malware payloads. Maybe grabbing session sso cookies is just so much easier cross-platform?

@edmorris4720

Жыл бұрын

i agree

@jmooroof1769

Жыл бұрын

what do you mean? I think found malware that grabbed chrome passwords

Fun fact your card details are also stored in these databases, albeit without the cvv code. An attacker can also grab your auto fill data such as addresses,ssn,phone numbers etc

Awesome this is a super informative and helpful video. Is there a similar version for MS Edge passwords?

@webofchaos2684

6 ай бұрын

To decrypt Edge modify the python script, replace global constant: CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE'])) CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Default\Login Data"%(os.environ['USERPROFILE'])) With Edge path: EDGE_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Local State"%(os.environ['USERPROFILE'])) EDGE_PATH = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"%(os.environ['USERPROFILE'])) and then change CHROME to EDGE in the rest of script where paths are being referenced.

That is unreal 😮

nice i gonna try it

Most browsers also autofill the passwords in the field. It shows as black dots but u can inspect element and change type from "password" to "text" and it shows in plain text. You can probs make a script to scrape through websites and extract plaintext. If you have a specific website you are looking for then it is even easier.

@pingmetal

Жыл бұрын

Definitely. That's the method I personnally use when I forget my own passwords.

@sven5666

Жыл бұрын

You can just go to settings and view the passwords.

@pingmetal

Жыл бұрын

@@sven5666 Yeah, but to me personnally the Developer tools method is just faster.

@kryptos1411

Жыл бұрын

@@sven5666 For that you need to know the system pw usually, this way u don't even need that.

@sven5666

Жыл бұрын

@@kryptos1411 sounds good, thanks :)

@John Hammond So i was running a few decryption tools and found that Firefox can't be cracked if there's a master password active. Have you seen any news about a decryption for master passwords? Edit: Fixed typo.

@webofchaos2684

Жыл бұрын

If a user has master password set your only option is to brute force the password.

@novousabbott4926

Жыл бұрын

​@@webofchaos2684That's what i was thinking but he said it's possible to crack Firefox. Maybe he just meant the vanilla version with no master pass.

@webofchaos2684

Жыл бұрын

Think he may be referring to Firefox without a master password set. All passwords and encryption key are stored in the key3.db file which is decrypt-able when no password is applied.

So basically don't use chromes browser or the variants because it can leak passwords on the local network, is all I got out of this?

@HadronCollisionYT

Жыл бұрын

not just chromium browsers, passwords from other browsers can also be stolen

@jdspecht682

Жыл бұрын

Yes use a dedicated password manager instead. Most of them have browser extensions that make them easy to use with any browser.

What about on Linux. And Firefox or edge are the on same of decryption

@jasonpreston2703

Жыл бұрын

Almost certainly yes. No reason they wouldnt be and it makes sense to use the same encryption standard besides anything else it would take unnecessary dev time to impliment a separate encryption standard for linux Edit: that answer was talking about chrome on linux but yeah edge and firefox use aes

@e995a1ad

Жыл бұрын

On linux the key used to encrypt passwords is typically stored in a wallet, like kwallet or gnome keyring. On my system for example, it's stored in kwallet, which is itself encrypted with my GPG key. So I have to type in the password to my GPG key after I log in.

@webofchaos2684

Жыл бұрын

Chromium Browsers in Linux are just as bad uses default password 'peanuts' and salt 'saltysalt' you can just build a AES decrypter in python.

@e995a1ad

Жыл бұрын

@@webofchaos2684 not true: if either gnome-keyring or kwallet are running, Chromium will generate a random 16-byte key and store it in the keyring.

@webofchaos2684

Жыл бұрын

@@e995a1ad you can bypass the key ring by using the default password and salt hashing it with AES-128-cbc method.

I love your content and appreciate your work, tho 1/5 of the video being a sponsored segment is a bit harsh.

when my Google chrome updated… I lost a WHOLE bunch of passwords. I have no idea how or why, I guess they did not sync properly ?? Is there any way I can find where they were saved locally ?? Or have they been overwritten 😭😭 (I am a mac user)

I'm negativity surprised, so the cracking is portable! Once you snapshot those 2 or 3 files you can payload them to the remote without the need to access local resources. Astonished they do not have alayer of Syskey encryption in the chain.

So what happens when passbolt gets compromised? Didn't this happen to last pass? I think I will take my chances with Chrome password manager..

@mattvasquez3741

Жыл бұрын

Also if someone has access to your local FS, you have bigger problems...

@jdspecht682

Жыл бұрын

He JUST showed what a bad idea that is.

@JanKowalski-fe4eb

Жыл бұрын

@@jdspecht682 Well... Lets say someone broke into your house, and ate your cake from the refrigerator(Chrome passwords). Would you be worried about that cake or that someone broke into your house? I think simmilar thing happens to storing passowords in browser's password managers. If attacker can access those files(chrome's), your machine is already compromised. I believe browsers password managers are not that bad after all :)

Does the complexity the password matter? Say like you use Passbolt to generate a password, and its 26 characters long with letters, numbers, symbols; etc. Will the script still be able to break the key?

@webofchaos2684

Жыл бұрын

Password length does not matter. Character length can be 300 characters long. encryption key is stored locally so decrypting passwords and other information can always be done.

@DayzGone

Жыл бұрын

@@webofchaos2684 Having an encryption key is not the same as having a hash, right? I forgot the password to one of my rar file. I was wondering if I could get the hash is it possible to break that to recover the password.

@webofchaos2684

Жыл бұрын

@@DayzGone no they are not the same a hash is an encrypted output of the password. If you have a hash of the password of the rar file it's possible to bruteforce the hash to get the password assuming the length is not too long.

I recently asked ChatGPT to do so using C# to read the sqlite file but sadly didn't try it out to confirm how efficient the solution was ( i sort of think the passwords weren't encrypted in that file )

@kodiererg

Жыл бұрын

Python makes it easier

@wtfdoiputhere

Жыл бұрын

@@kodiererg sure it does

0:06 LMFAO 😂😂😂

Cipher scan ?

What about Firefox? 🤔

Early :3

What about OSX, Chromebook, Linux distros, Android, iOS - can Chrome be hacked like this across all platforms?

@webofchaos2684

Жыл бұрын

This attack works on Windows,OSX, Linux and Chromebook, have not tried this on Android or IOS yet.

I have been watching your videos for quite a long time now and I really do appreciate what you offer, as am currently much of on the side of software development, I would really want to venture into cyber security career but much on a self taught basis, I was requesting if you can drop us a simple road map to learning and becoming one. Thanks

@AJSstvan

Жыл бұрын

Up 🙏🍀

i remember back when i was a kid, playing around with dark comet. it had this built in and id use it on my mates (pretending i had "coded a program") and then use it to scrape their passwords and almost always they would have the same pass for everything so I'd login to their Minecraft accounts. we were 12-13 so it was a lot more innocent. nice to actually no how to do it for real though rather than off the shelf!

I wonder if there is a similar approach for stored credit cards in the web browser.

@webofchaos2684

Жыл бұрын

Credit cards are stored in the file Web Data

@binarytech8457

Жыл бұрын

@@webofchaos2684 Thx for the answer.

Mr hommand, where should I get started to learn the hacking, which books would you prefer?

This is really only an issue on one platform: Windows. Windows is the only mainstream OS to not provide per-application secure storage. As an example, on Windows it is impossible for your browser to prevent a random download from accessing all stored passwords/cookies. This is a primary reason account hijacking is popular on Windows but not on other platforms. Linux has AppArmor/SELinux (though often unused), MacOS has keychain, iOS & Android has app-isolated storage by-default for every app, and ChromeOS uses the same-origin-policy.

Hello can you pls take it slow, all i want to know is can i still access a password mail which i enter on my chrome

Did you know that you can Hijack ec2 instances If you got the root iam Account.

Im actually shocked that it was rhat easy. Isnt google basically saying give us all your passwords si we can basically leave them lying sround on disk? Is there nothing else that would slow an attacker down?

Use a passphrase to double encrypt the passwords. Simple thing

Is there any way I can see my gmail password on mac? I don't remember the password and it is not saved in password manager. Please help 🙏🥺🥺