i mean no matter where you store it people can just find it and look for it inside of their script

@@Luna5829 Encryption keys be generated from text, so in reality the can store locally with a password as the encryption key. Also when the browser is online it can use the browsers company servers, so no need to use a local copy in that scenario anyway.

For your convenience of course

@@retzerR Can you imagine how ticked someone would be if the internet went down and their ISP asked them to log in to their router but the browser stored the encryption keys exclusively in the cloud? I don't think any do that.

@@jmr Good point, but they can also be stored locally, just with a password used to generate the encryption key, which is never stored. At least then the password will have to be brute forced, or social engineered

This is why you use hardware encryption keys, or other 2fa for everything, including browser based password systems

@@JeremyPatMartin what do you recommend? I want to have a hardware kinda thing to store my passwords , thank you

I commented before your last paragraph then realised it said the same thing 😂

The weakness looks a LOT like windows instead of chrome. Don't save your chrome passwords locally on a windows machine

where it belongs. in the corner. an eternity in the time-out corner.

😢

Imagine using IE 😂

​@_GhostMiner Edge is better than chrome, has been for a while.

To be honest on most sites you can just copy paste the password from the password field of the website into any text field.

@@UNagano589 🤣😂😂

You're right in some contexts, but it needs more precision; you can undo many blurring effects and you can undo some pixelated censors. The vulnerable pixelated censors are the ones using many pixels to censor the content, king of like a pixelated "low res blur effect", so to speak. In this context, the one John is using uses whole squares, which does not seem to leak info from under, so I'd reckon it is not vulnerable to that attack vector. I personally would censor using a plain color bar, as it is never affected by that attack.

Wasn’t it also just brute-forcing instead of decrypting? Think of the pixelated blur as something like a one-way hash function: blurring the same text results in the same pixel values, but reversing is hard.

@@blablubb1234 imagine a two-way hash function

Depix, for example, if I remember correctly. But yeah, unlikely tp work here.

that only works with shitty pixelated censoring.

I haven't seen this work in quite a long time.

​@@parkerlreedI have been successfully using this method for 10 years on chrome, last time was yesterday

@@parkerlreed it does still work i think

yep, it still does work...

What this video can help with is when can pull someone password files to your pc( using powershell script, for example) or when you get a shell access only

How sir ?

Definitely. That's the method I personnally use when I forget my own passwords.

You can just go to settings and view the passwords.

@@sven5666 Yeah, but to me personnally the Developer tools method is just faster.

@@sven5666 For that you need to know the system pw usually, this way u don't even need that.

@@kryptos1411 sounds good, thanks :)

Up 🙏🍀

8:51 Same for me, the exact same- URL, User Name there but Password is blank. It also shows 'utf-8' codec can't decode byte 0xf4 in position 0: invalid continuation byte [ERR] Unable to decrypt, Chrome version

More accurately, the script needs to run in the same security context as the target user (having local administrator privileges on the same computer is insufficient). Let's say you have/gain physical access to a user's computer, but you can't and/or don't want to sign on as them. Assuming Windows: maybe you don't know/have their Windows password and you don't want to change it to a known password. You boot the system with something like Hiren's and set a password on and enable the built-in administrator account, then boot the computer and sign on with the built-in administrator account. Even after tweaking the script to target the user's (not built-in administrator) Chrome, you will see a message something like, "(-2146893813, 'CryptUnprotectData', 'Key not valid for use in specified state.') [ERR] Chrome secretkey cannot be found."

To decrypt Edge modify the python script, replace global constant: CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE'])) CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Default\Login Data"%(os.environ['USERPROFILE'])) With Edge path: EDGE_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Local State"%(os.environ['USERPROFILE'])) EDGE_PATH = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"%(os.environ['USERPROFILE'])) and then change CHROME to EDGE in the rest of script where paths are being referenced.

Actually, what he showed is not the real key, but an encrypted key. To get the real key, you can only decrypt it on the same computer using the Windows API CryptUnprotectData

string multiple words together with extras = easy for human, difficult for gpu to brute force. random characters= difficult for human, very easy for gpu brute force i use 'pass' from passwordstore

@@supyrow Yeah and the very nature of a master/backup password is that you may not need to use it for years. Now, what was that phrase again? This is not hypothetical. I recently encountered a stash of old engineering data from 10 years ago. Could I remember the pass phrase? Nope? Fortunately it wasn't a huge loss.

@@saumyacow4435 well, with gpg, yeah there is a passphrase to unlock, or you can use the non-public file to unlock as well. dunno man. i've never forgotten my master passphrase, i change it annually and use it often enough to not forget it,. it's has become quite common recently to use multiple word chains

don't use it

@@supyrow any reason why?

It can be downloaded and than also decrypted on your own machine. Very easily! Do avoid it put a master password - that do a little bit harder to decrypt all your saved passwords. The bad person need first the master password - bruteforce but If you choose a very long Password for that, than it takes years to bruteforce it. But Choose your own password managment system what do you like. 100% Safty is not given in the IT-World.

Yes that user needs to be currently logged on.

That will work up to a point; with a Live OS, anything unencrypted on the disk can be read. BitLocker / Password protected browsers can help though.

Yes, drive must be encrypted and a strong login.

ur funny 😅

Encrypting makes it slightly more difficult to steal the data rather than storing it directly in plaintext in a file.

i agree

what do you mean? I think found malware that grabbed chrome passwords

which means any malicious programs you run can access it. Tip: dont run games on your main account or even your main computer.

Keylogger and other malware can be caught by even the most basic of AVs these days. While a simple program that only does file read operations on disk might not be flagged by AV.

@@schizo5189 Keyloggers can be hardware devices that are not detectable by AVs. AVs have a very bad record of finding zero day exploits. Physical security is important. But if you have access and can get admin rights a keylogger can be installed to be ignored or undetectable by AVs. If AVs were the total security solution then there would be no encrypted drives or stolen data - which is happening every day.

I think no matter where you install the browser, that these extra files are always stored in that directory 🤔 and if you changed it they might just scan the whole file system for it

OSX location = /Library/Application Support/Google/Chrome/Profile/Login Data Linux = /home/{user}/.config/google-chrome/Default/Login Data Encryption key stored differently as well.

Credit cards are stored in the file Web Data

@@webofchaos2684 Thx for the answer.

To use script on Edge change Global constant to: # Reads from Microsoft Edge Directory CHROME_PATH_LOCAL_STATE= os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Local State"%(os.environ['USERPROFILE'])) CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"%(os.environ['USERPROFILE']))

How does master password this work?

Also if someone has access to your local FS, you have bigger problems...

He JUST showed what a bad idea that is.

@@jdspecht682 Well... Lets say someone broke into your house, and ate your cake from the refrigerator(Chrome passwords). Would you be worried about that cake or that someone broke into your house? I think simmilar thing happens to storing passowords in browser's password managers. If attacker can access those files(chrome's), your machine is already compromised. I believe browsers password managers are not that bad after all :)

Python makes it easier

@@kodiererg sure it does

Almost certainly yes. No reason they wouldnt be and it makes sense to use the same encryption standard besides anything else it would take unnecessary dev time to impliment a separate encryption standard for linux Edit: that answer was talking about chrome on linux but yeah edge and firefox use aes

On linux the key used to encrypt passwords is typically stored in a wallet, like kwallet or gnome keyring. On my system for example, it's stored in kwallet, which is itself encrypted with my GPG key. So I have to type in the password to my GPG key after I log in.

Chromium Browsers in Linux are just as bad uses default password 'peanuts' and salt 'saltysalt' you can just build a AES decrypter in python.

@@webofchaos2684 not true: if either gnome-keyring or kwallet are running, Chromium will generate a random 16-byte key and store it in the keyring.

@@e995a1ad you can bypass the key ring by using the default password and salt hashing it with AES-128-cbc method.

"thank you for your work"? did i get that right without a translator? :o

@@kipchickensout yup

@@kipchickensout yes(da)

nice:)

software that wants access to the keyring always has to ask for permission from the user first (at least the first time) even if it is unlocked afaik

Default path defined in script: CHROME_PATH_LOCAL_STATE = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data\Local State"%(os.environ['USERPROFILE'])) CHROME_PATH = os.path.normpath(r"%s\AppData\Local\Google\Chrome\User Data"%(os.environ['USERPROFILE'])) If you need a custom path you can modify it.

what if you don't have the internet and you want to the password of the service provider for login to renew the plan? Also, if someone has access to your PC, they can do anything.

"stored in memory" is not safe either. It needs to be encrypted in memory and even in cpu cache/registers.

Using the python script you can only decrypt them on windows mainly because of this import win32crypt uses the win32 API which only works on Windows.

Works for browser versions 80+