Database Info

accounts.db encoding

Sorry if this is the wrong place;
I'm trying to retrieve a Google account password stored on my phone. I don't want to change it, or go through the lengthy password recovery system (it's a very old account, I can't remember the security questions and the recovery email is long gone).
I read an article about how Google passwords were stored in plain text, in the accounts.db database. Some people said this is still the case as of JB (I'm on ICS).
To test this, I opened the database on my computer but the passwords are not in plain text. Instead, each is a 70-character long string, making it look like some sort of hash -- but I thought that storing passwords as hashes would not work because they cannot be decrypted, so perhaps it's an encoding.
Does anyone know what sort of encoding is used for these? And is it possible to decrypt back to plain text?
Thanks,
Mark

Not sure bro..but the accounts.db doesn't contain your password or so I think
I think it only contains a authentication token..no real password is stored..I think..I know this is the case for 2 step authentication users..but not sure about the rest
If it really is encrypted,then it must be encrypted using some kind of password(which you also do not know.. Google wouldn't be stupid to use the same password for encryption all phone's accounts.db)
However,you could login into your account from the stock browser right?
Could it be used to change passwords?

_Mark_B said:
Sorry if this is the wrong place;
I'm trying to retrieve a Google account password stored on my phone. I don't want to change it, or go through the lengthy password recovery system (it's a very old account, I can't remember the security questions and the recovery email is long gone).
I read an article about how Google passwords were stored in plain text, in the accounts.db database. Some people said this is still the case as of JB (I'm on ICS).
To test this, I opened the database on my computer but the passwords are not in plain text. Instead, each is a 70-character long string, making it look like some sort of hash -- but I thought that storing passwords as hashes would not work because they cannot be decrypted, so perhaps it's an encoding.
Does anyone know what sort of encoding is used for these? And is it possible to decrypt back to plain text?
Thanks,
Mark
Click to expand...
Click to collapse
i have the same problem , please help

SplashID v7 upgrade security issue

Besides the issues SplashData has with their SplashID v7 android upgrade losing many customers data, there is also a very worrying security issue which splashdata ignores = and actively censors, my messages regarding this on their FB page have been deleted and I am blocked from commenting our writing there)
Here is the issue:
The new SplashID version 7 had a cloud sync feature (30 day free trial, then for a fee). When first starting the upgraded version (which may have been installed automatically on Android if one allows auto upgrades!), one first has to again enter one's email address/username, and then the password (which is the one used to encrypt one's database containing all one's private, sensitive data!). Then the upgrade asks whether one wants to try the cloud sync feature.
Even if one declines and opts to stay with the existing Wi-Fi sync feature only(which does not need a cloud account), the upgrade goes ahead and automatically creates such a cloud account on splashdata's servers.*and it uses the same password* for this. (In fact as further part of the upgrade procedure one needs to log into those cloud servers using that password after receiving an activation link in email.
So, splashdata leaks the master password which one uses to secure one's most private data (credit card pins, login password etc) into their cloud, without telling that this will be fine, not asking permission.
There is no info whether the password is stored securely (doubt it), whether it is in ask cases transmitted securely (doubt that too) and anyhow, once this has happened one had lost control over that most important password. It's burnt.in the wild, out of one's own control
Note that changing the password on one's own copy of SplashID us a good idea after that, but any old copy of one's encrypted database that might still live on any old disk backup, cloud service (dropbox etc) or SD card somewhere, us now vulnerable.
And because splashdata in their 'wisdom' associated one's email address (and thus identity) with that password, it's easier for hackers to fund it.better companies than splashdata have lost password in the past.
It is even a very bad idea to user the same password for s cloud service as one uses for securing one's private data. Forcing this into users without permission or warning is almost criminal.
Sent from my GT-N7000 using Tapatalk 2

sejtam said:
Besides the issues SplashData has with their SplashID v7 android upgrade losing many customers data, there is also a very worrying security issue which splashdata ignores = and actively censors, my messages regarding this on their FB page have been deleted and I am blocked from commenting our writing there)
Here is the issue:
The new SplashID version 7 had a cloud sync feature (30 day free trial, then for a fee). When first starting the upgraded version (which may have been installed automatically on Android if one allows auto upgrades!), one first has to again enter one's email address/username, and then the password (which is the one used to encrypt one's database containing all one's private, sensitive data!). Then the upgrade asks whether one wants to try the cloud sync feature.
Even if one declines and opts to stay with the existing Wi-Fi sync feature only(which does not need a cloud account), the upgrade goes ahead and automatically creates such a cloud account on splashdata's servers.*and it uses the same password* for this. (In fact as further part of the upgrade procedure one needs to log into those cloud servers using that password after receiving an activation link in email.
So, splashdata leaks the master password which one uses to secure one's most private data (credit card pins, login password etc) into their cloud, without telling that this will be fine, not asking permission.
There is no info whether the password is stored securely (doubt it), whether it is in ask cases transmitted securely (doubt that too) and anyhow, once this has happened one had lost control over that most important password. It's burnt.in the wild, out of one's own control
Note that changing the password on one's own copy of SplashID us a good idea after that, but any old copy of one's encrypted database that might still live on any old disk backup, cloud service (dropbox etc) or SD card somewhere, us now vulnerable.
And because splashdata in their 'wisdom' associated one's email address (and thus identity) with that password, it's easier for hackers to fund it.better companies than splashdata have lost password in the past.
It is even a very bad idea to user the same password for s cloud service as one uses for securing one's private data. Forcing this into users without permission or warning is almost criminal.
Sent from my GT-N7000 using Tapatalk 2
Click to expand...
Click to collapse
Ouch, that sounds a bad idea. If the user doesn't want a remote account made, they should respect that. Can you give me any more details about this, I would like to contact them and request some proper response to this. While they might not be leaking the plaintext password, anything that can be "opened" with your password is a significant enough leak, as it would allow an attacker to verify they have the right password.

pulser_g2 said:
Ouch, that sounds a bad idea. If the user doesn't want a remote account made, they should respect that. Can you give me any more details about this, I would like to contact them and request some proper response to this. While they might not be leaking the plaintext password, anything that can be "opened" with your password is a significant enough leak, as it would allow an attacker to verify they have the right password.
Click to expand...
Click to collapse
Not much more that I already said. I am a long-time user of their SplashID (Mac) Desktop and Android app to store all my credit card, bank acount and yes, many systems passwords in.
The database they use is encrypted with a 'master password' which one has to enter on ones' Android (or iPhone, etc) or Desktop everytime to
unlock and decrypt (in memory), so that one access the data.
The same password is used on both the mobile and desktop of course.
A few days ago, an upgrade to SplashID v7 was made available on the Google Play store. I don't allow 'automatic' updates (though I am sure a lot of folks do!), but this time I also did not really check what the upgrade offered, and clicked 'UPDGRADE ALL' when it was offered along with a nunber of other upgrades. So it got installed.
When i subsequently opened SplashID again, it told me about all the shiny new features (cloud sync etc) and as normal asked me for my password (it also asked for my email address. I though that this was for them to check my purchase/license ans what features woudl be enabled)..
I thought that it would then show me my data. But wrong. Instead it offered me a selection whether I want to use the new 'cloud sync' feature (30 day free trial, later for $$), or stay with the normal 'wifi sync'.
I opeted for the latter (because I don't trust having my data sent to the cloud).
Anyway, the next thing I get is a message: (paraphrasing) "we have created your cloud account, you will get an email and will have to verify your email). Sure enough, I get an email:
Thank you for signing up for SplashID Safe Personal Edition!
To activate your account, please verify your email address by clicking the link below: Verify Email
Then check your email for our SplashID Safe Welcome message.{/QUOTE]
The link goes to: https://www.splashid.com/personal/webclient/login.php
I had to again ther enter my email address, and *the same password* that I entered before (which I thought would be for my private data-store).
Yes, that same password was used to create my account on their cloud server, even though I opted for the Wifi Sync *only* and never
asked for a cloud-sync.
Nor did the app tell me that the same password would be used to secure that aco****.
The issues with this are self-evident:
a) my most secure password, the one used to secure my data on my mobile and on my desktop is now 'leaked' to their cloud account
b) I have *no* idea how secuerly that password was transferred (in clear, encrypted, just a hash), nor how securely it is stored
c) it clearly is linked to my cloud-account on their website, so
- someone somehow learning that password could 'verify' it by accessing that account
- if someone hacked their system and accessed their database, that link would be apparent to them
d) I have nost *all control* over securing that password myself. It is 'burnt', 'in the wild'
e) Any pass backups of my secure SplashID database that may live on SD cards of mine, on backup disks, which may have
been copied to the cloud (dropbox, others) are now vulnerable. It is no use for me to change this password here now, as
old copies that may still exist somewhere are still encrypted with this password (and I cannot change them back).
Yes, I am trying to limit exposure for that password data file as much as possible, but eg Titatium Backup may have at some point in teh past backed it up and copied a backup to the cloud (yes, that is also encrypted, but once that featire failed).
More that that, of course users who are not as security conscious may have opeted for 'could sync'.
While I have not tried this feature myself, it sounds to me like thsi does copy the teh data to SplashID's cloud and
there secures it too only with that one single password.
So many users wh may not have thought all this out may have opted for the 'CloudSync' trial, and not only have their
password 'leaked'/'burnt' now, but also have all their data in the cloud, again secured only with a password that is no longer in their sole possession.
In fact, any secure, trustworthy system would have
a) been *very* upfront about what they are going to do with the password and the cloud account
b) used a separate password to secure the cloud account
c) only stored my encrypted copy of the database in their cloud, without *them* having the password for it
d) done any syncing on the client (ie, transfer the complerte encrypted password to the mobile or desktop where the comparisonupdates would happen) and then copied back again a secured file, that was encrypted on the mobile).
Click to expand...
Click to collapse

More discussion on SplashID's own site: http://forum.splashdata.com/showthr...ically-send-in-background-to-splash-id-server

[Q] recover password from email app

Hi Guys,
my University has this dumb policy that you need to change your password every month. So I did that and immediately changed it on the phone too, so that I can receive my mails. The mail login is the same as on the main platform of the university. Now I need to login in the main platform in order to get the payment information for the new semester, but can't remember the freaking password. A simple reset or forgotten option is unfortunately not available. If you've forgotten your password, you need to go to a special facility where a pin code is handed out. With that you can reset your password. Bad luck me, I'm out of town and can't go to that facility. So is there any way to view the password that is stored in the android stock email app. I'm using android 4.4.
I would really appreciate your help.
Kind regards,
Martin

Is there a portable password manager that can also log into my computer?

Hello,
I was wondering if there is a password manager out there which can be stored on a flashdrive so that I can plug it in to log into my PC among other applications and websites?
I have never used a password manager before, and since recent scandals involving password theft, I feel like a lot of people are posting about the benefits of a password manager, so I felt I should try a password manager as well. I want to go the whole nine yards though. I want an immersive experience to REALLY get a feel of whether or not I will use a password manager, so I want to change everything, including my google password and Microsoft password, and let my password manager handle keeping them.
However, my Microsoft password is linked to my PC, so my computer password changes when my Microsoft account password changes. If I change it to some randomly generated strong password I would not remember it and would depend entirely on the password manager, which is why I want to know if there is a portable application that can log into my PC for me as well.
Also, my google account is linked to my phone, and it keeps record of my call history, text messages, and contacts. These are things I want to be retained whenever I get a new phone, factory reset my current phone, or clean install a custom ROM, so is there a password manager that handles this as well? The problem with apps is the fact that we need Google Play Store to download and install them officially, and we need a google account to access Google Play Store. I know that I can sideload an apk from my computer to my phone, but let's say I get a new phone at Best Buy and just CAN'T wait to get home and start using it. When I boot up it'll ask for my Google account so it can restore my contacts at the very least, but I'd be dependent on my password manager and will not be able to login without it. Is there something I can do that will allow me to login immediately upon turning on this shiny new device?
I've tried Dashlane, they don't have a remedy for the things above, and it seems like most password managers do not. On top of Dashlane's android overlay doesn't pop up when adding a google account, whether it just be for gmail or other google services. I am pretty sure that my request is a stretch, and if so, I'll probably just continue to manually type in my own passwords, but I figured I'd ask and see if anyone knew of an app that might do what I want or is migrating in that direction.
Thanks,
Weilun

How can I isolate my android from my desktop PC and continue to use chrome on each ?

I have saved usernames and passwords for various websites on the desktop (Windows) PC, for my convenience via Google Chrome. I have several android devices (phones) which are able to access these saved passwords since they are linked together. I want to save these passwords to my PC only. And restrict some from my androids, ie. banks, brokerage houses, Amazon and pay-pal. Now, if I have mobile apps associated with these sites, I can block the passwords and usernames. But, a search via google for the website login page (by-passing the app) will display my username and password. Although the password is not visible, it's still there and allows access to my account. I'm not sure if anyone would know what to look for if my cell was lost or stolen, but it's still unnerving to think it could possibly happen. So, I am searching for a way to segregate my PC from my androids, and still be able to use Crome on all. A Google search gets me answers to all imaginable questions, except for the one I ask. Maybe, I just don't know how to form the question to where Google can understand it.

You should be able to sign out on the other devices.
Sent from my HTC_0P6B using Tapatalk

DudeBoy1 said:
I have saved usernames and passwords for various websites on the desktop (Windows) PC, for my convenience via Google Chrome. I have several android devices (phones) which are able to access these saved passwords since they are linked together. I want to save these passwords to my PC only. And restrict some from my androids, ie. banks, brokerage houses, Amazon and pay-pal. Now, if I have mobile apps associated with these sites, I can block the passwords and usernames. But, a search via google for the website login page (by-passing the app) will display my username and password. Although the password is not visible, it's still there and allows access to my account. I'm not sure if anyone would know what to look for if my cell was lost or stolen, but it's still unnerving to think it could possibly happen. So, I am searching for a way to segregate my PC from my androids, and still be able to use Crome on all. A Google search gets me answers to all imaginable questions, except for the one I ask. Maybe, I just don't know how to form the question to where Google can understand it.
Click to expand...
Click to collapse
Create an alternate Gmail address to use on the androids and don't use that Gmail on PC.
Or
Have you tried signing out of chrome browser on the androids and set it to not remember your username and password?
Sent from my SM-S903VL using Tapatalk