Thunderbird has forgotten password - and so have I!

For some reason both Thunderbird and myself have forgotten the password for one of my email accounts. On my laptop it is stored and remembered and I wonder if anyone knows where in the roaming appdata of Vista this information is stored.

I'd like to overwrite the email settings with those of the laptop, but don't want to lose all my current email. If I have to formally change this password it affects a whole lot of other stuff - it would be easier during a period where I'm very time poor - just to have the original one recovered.

Just install a sniffer (wireshark i.e.) on your laptop. Sniff port 110 traffic (for POP3) and collect your email. Your password will be sent in the clear, easily readable in the dump.

One of these might jog your memory:

http://www.passcape.com/mozilla_password_recovery.htm

http://www.nirsoft.net/utils/mailpv.html

edit -- you might try Snadboy's Revelation 2.0 to reveal asterisk passwords.

http://www.snadboy.com/

Many thanks, I'll give them a try! In fact the mailpv has found the start of the pass, but I would need to buy the full copy to get something to crack the rest of it. Could be worth it though - I'm always forgetting passwords.

Quote:

---

Originally Posted by Moira

I'm always forgetting passwords.

---

I never save passwords in any of my apps. Manually entering them each
time may be a pain to some, but it's good discipline. Snadboy comes in
real handy. I use it regularly on OPM's (other people's machines). Freaks
people out when they see how easy it is to circumvent some apps. Doesn't
work all the time though (won't get me AOL passwd's anymore -- they built
in some protection). Fwiw, I ALWAYS delete Snadboy when I'm done. I
do not like leaving tools like that installed on a harddrive. Anyones.

Sounds a good way to work! I think more people ought to be shown just how easy it is to circumvent a lot of so called safe password protected places. And don't use the same password for each login - however strong your pass is, put it in a Word document and it can be retrieved within seconds, not because it's a weak password, but the method of hiding passwords in Office is not particularly good. I have to admit, this is the older versions of Word, I haven't tested Office 2007 or even 2003 but it's probably the same.

Likewise a windows login. I used to have a program that retrieved logins very easily due to the poor way Windows stored them. The free program would use a dictionary attack and the paid for version would brute force - often not even necessary.

LOL, isn't that just so AOL? I often wonder how such a lame ISP in lots of ways can sometimes end up being the only sodding program that isn't vulnerable to a particular hack!

Is it really safer? I mean if your system is compromised to the point where they can search out a file containing an encrypted password stored, couldn't it also contain a key logger which will grab your password when you type it?

Credit me with some common sense and computer knowledge, please!. I think I might know if I had a keylogger installed, also in this case the lady in question simply had her laptop stolen from the park (God knows what she was doing in the park with it), and it doesn't take a l337 h4X0r to do that!

Actually maybe I should have kept quiet about computer know how. What am I meant to be doing with this Wireshark thing? I asked it to capture a particular file - app data wasn't accessible so I pointed it to imap mail, local store. Nothing happened except when I eventually stopped it, having captured the marvellous total of zero packets, I got a message telling me to turn off promiscuous mode in capture options! Why is it calling my mail promiscuous? Anyway I can't see how to turn this off, I tried several more likely looking files but it's just not capturing packets or packets aren't being generated.

The partial password retrievers have given me part of the pass, which is a big help, but they don't give me the whole word, so I'm still stuck.

PS How do I sniff a port?

I didn't mean in your or her case, Moira, I meant in general.

Wireshark is a network analyzer. You use it to capture network traffic.
Start it up.
Go to Capture -> Options.
Pick the correct network interface.
Set Capture filter to: port 110
Click start..

Collect your email.

Stop capture.

Have a look at the data. Email (POP3, port 110) is all clear text. I am assuming you use POP3 to collect your mail.
For IMAP (also clear text) you would capture port 143.

In fact, now the copy of Thunderbird on the laptop has developed a fault where it won't retrieve mail, saying that it can't connect to either imap.aol.com or pop.gmail.com because the SSL protocol has been disabled. I haven't a clue what it's on about, I transferred the roaming app data from here across there to sort it out and have belatedly realised that this will also leave the laptop not having the correct email account password - unless for some reason it does, I have no idea why it suddenly can't be found on this PC.

Anyway if it can't connect to imap then it can't pick up the relevant account. I'm more concerned with why it's doing that really, but not greatly so on the laptop because as soon as I can I intend to reinstall. I might just have to change the password meanwhile!

AFAIK gmail has always used SSL. If your looking for that password you're out of luck as SSL will encrypt the connection. Not sure about AOL needing SSL though.

Did you try Snadboy's Revelation? I just tested it on my gmail imap acc't loaded in Outlook 2003 and it gave up the password right away. Should work on Thunderbird.

Sorry, it did absolutely nothing. The only text it ever revealed was "Folder View" and even that was impossible to drill into any further. I ran the cursor thing over every folder in Thunderbird roaming app data, and the Thunderbird installed program, and finally the Thunderbird mail interface itself. Not a single thing was ever revealed at all.

I don't know why I'm getting these errors in the version on the laptop, nothing has significantly changed, however as I had tried overwriting with the data on this PC, I'm assuming that the laptop too, has now lost its password. I think my only option is to change it.

You don't run Revelation's cursor over a folder. You run it over asterisked passwords in the account settings. Only works on asterisked passwords in config menus. HTH.

Ah well, it wouldn't work then. The password box is just blank, no stars there at all.