PasswordMaker - User contributions [en]

NavTree

2012-01-13T19:36:09Z

Tanstaafl:

[[Donations_and_Expenses|Donations / Expenses]]
{{#tree:openlevels=2|id=MainMenu|root=Main Menu|
* Site
** [[Introduction]]
** [[How it works]]
** [[Screenshots]]
** [[News & Awards]]

* Editions
** Mozilla Firefox
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Download|Downloads]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/GettingStarted|The Basics]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Advanced|Advanced]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Tips&Tricks|Tips & Tricks]]
*** [[F.A.Q.#Firefox_.2F_Gecko_edition|FAQ]]

** [[Javascript]]
** [[Click]]
** [[Opera Widget]]
** [[Google Chrome]]
** [http://itunes.apple.com/us/app/passwordmaker-org-password/id359001896?mt=8 iPhone]
** [[Android]]
** [[Desktop]]
*** [[Native]]
*** [[Java]]
** [[Yahoo! Widget]]
** [[Command-line]]
** [[PHP / Mobile]]
** [[Mac Widget]]
** [[Python]]
** [http://passwordmaker.sourceforge.net/passwordmaker.html On-line]
** [[Maemo]]
** [http://passwordmaker.sourceforge.net/wallpapers/index.xhtml Wallpapers]

* Help / Support
** [[F.A.Q.|FAQ]]
** [[Tutorials]]
** [http://forums.passwordmaker.org Forums]
** [http://passwordmaker.sourceforge.net/chat/chat.php Chat Room]
}}
{{#tree:openlevels=0|id=toolbox|root=|
* Tool Box
** [{{fullurl:Special:Whatlinkshere|target={{FULLPAGENAMEE}}}} What links here]
** [{{fullurl:Special:Recentchangeslinked|target={{FULLPAGENAMEE}}}} Related changes]
** [[Special:Upload|Upload file]]
** [[Special:Specialpages|Special pages]]
** [http://passwordmaker.org/index.php?title={{FULLPAGENAMEE}}&printable=yes Printable version]
** [[Special:Recentchanges|Recent changes]]
}}

NavTree

2012-01-13T19:35:32Z

Tanstaafl:

[[Donations_and_Expenses|Donations / Expenses]]
{{#tree:openlevels=2|id=MainMenu|root=Main Menu|
* Site
** [[Introduction]]
** [[How it works]]
** [[Screenshots]]
** [[News & Awards]]

* Editions
** Mozilla Firefox
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Download|Download]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/GettingStarted|The Basics]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Advanced|Advanced]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Tips&Tricks|Tips & Tricks]]
*** [[F.A.Q.#Firefox_.2F_Gecko_edition|FAQ]]

** [[Javascript]]
** [[Click]]
** [[Opera Widget]]
** [[Google Chrome]]
** [http://itunes.apple.com/us/app/passwordmaker-org-password/id359001896?mt=8 iPhone]
** [[Android]]
** [[Desktop]]
*** [[Native]]
*** [[Java]]
** [[Yahoo! Widget]]
** [[Command-line]]
** [[PHP / Mobile]]
** [[Mac Widget]]
** [[Python]]
** [http://passwordmaker.sourceforge.net/passwordmaker.html On-line]
** [[Maemo]]
** [http://passwordmaker.sourceforge.net/wallpapers/index.xhtml Wallpapers]

* Help / Support
** [[F.A.Q.|FAQ]]
** [[Tutorials]]
** [http://forums.passwordmaker.org Forums]
** [http://passwordmaker.sourceforge.net/chat/chat.php Chat Room]
}}
{{#tree:openlevels=0|id=toolbox|root=|
* Tool Box
** [{{fullurl:Special:Whatlinkshere|target={{FULLPAGENAMEE}}}} What links here]
** [{{fullurl:Special:Recentchangeslinked|target={{FULLPAGENAMEE}}}} Related changes]
** [[Special:Upload|Upload file]]
** [[Special:Specialpages|Special pages]]
** [http://passwordmaker.org/index.php?title={{FULLPAGENAMEE}}&printable=yes Printable version]
** [[Special:Recentchanges|Recent changes]]
}}

Firefox/Mozilla/SeaMonkey/Flock/Netscape/Download

2012-01-13T19:33:33Z

Tanstaafl: /* Beta Versions for Firefox/SeaMonkey/Mozilla/Netscape/Flock */

==Download PasswordMaker for Firefox/Mozilla/SeaMonkey/Flock/Netscape==
PasswordMaker 1.7.8 can be downloaded securely from [https://addons.mozilla.org/en-US/firefox/addon/469 here].

*Version history and release notes can be found [https://addons.mozilla.org/en-US/firefox/addons/versions/469 here]. Release notes for versions 1.6.1 and earlier can be found [http://passwordmaker.sourceforge.net/installation2.html here].

==Beta Versions for Firefox/SeaMonkey/Mozilla/Netscape/Flock==

There are currently no beta releases. The last beta release was 1.7.8b1.

Firefox/Mozilla/SeaMonkey/Flock/Netscape/Download

2012-01-13T19:32:31Z

Tanstaafl: /* Download PasswordMaker for Firefox/Mozilla/SeaMonkey/Flock/Netscape */

NavTree

2012-01-13T19:29:16Z

Tanstaafl:

[[Donations_and_Expenses|Donations / Expenses]]
{{#tree:openlevels=2|id=MainMenu|root=Main Menu|
* Site
** [[Introduction]]
** [[How it works]]
** [[Screenshots]]
** [[News & Awards]]

* Editions
** Firefox / Mozilla
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Download|Download]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Beta|Beta Versions]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/GettingStarted|The Basics]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Advanced|Advanced]]
*** [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Tips&Tricks|Tips & Tricks]]
*** [[F.A.Q.#Firefox_.2F_Gecko_edition|FAQ]]

** [[Javascript]]
** [[Click]]
** [[Opera Widget]]
** [[Google Chrome]]
** [http://itunes.apple.com/us/app/passwordmaker-org-password/id359001896?mt=8 iPhone]
** [[Android]]
** [[Desktop]]
*** [[Native]]
*** [[Java]]
** [[Yahoo! Widget]]
** [[Command-line]]
** [[PHP / Mobile]]
** [[Mac Widget]]
** [[Python]]
** [http://passwordmaker.sourceforge.net/passwordmaker.html On-line]
** [[Maemo]]
** [http://passwordmaker.sourceforge.net/wallpapers/index.xhtml Wallpapers]

* Help / Support
** [[F.A.Q.|FAQ]]
** [[Tutorials]]
** [http://forums.passwordmaker.org Forums]
** [http://passwordmaker.sourceforge.net/chat/chat.php Chat Room]
}}
{{#tree:openlevels=0|id=toolbox|root=|
* Tool Box
** [{{fullurl:Special:Whatlinkshere|target={{FULLPAGENAMEE}}}} What links here]
** [{{fullurl:Special:Recentchangeslinked|target={{FULLPAGENAMEE}}}} Related changes]
** [[Special:Upload|Upload file]]
** [[Special:Specialpages|Special pages]]
** [http://passwordmaker.org/index.php?title={{FULLPAGENAMEE}}&printable=yes Printable version]
** [[Special:Recentchanges|Recent changes]]
}}

Talk:Introduction

2009-07-23T14:37:36Z

Tanstaafl: /* Comments welcome */

==Comments welcome==
What about the security of the rest of the pages in a Web app? Does each page need to go through the same authentication process after the login is successful?

: Not sure exactly what you mean... the sole purpose of passwordmaker is to generate your passwords
: for different sites, and to help keep you safe from phishing attackes and the like. It can also
: populate the username and password fields for you. But it has nothing to do with website encryption.
: [[User:Tanstaafl|Tanstaafl]] 14:57, 24 March 2009 (EDT)

Quit working with NetFlix and Firefox 3.5. Any workarounds.

: Yeah, I [http://forums.passwordmaker.org/index.php/topic,1629.0.html reported this already], and Erics looking at it...
: --[[User:Tanstaafl|Tanstaafl]] 14:37, 23 July 2009 (UTC)

F.A.Q.

2009-04-25T20:12:34Z

Tanstaafl: /* What if I forget my Master Password? */

== General ==

=== What browsers/platforms are supported? ===

*The extension works with some of the most popular [http://en.wikipedia.org/wiki/Gecko_(layout_engine) Gecko] based web browsers, including: [http://www.mozilla.com/en-US/firefox/ Firefox], [http://www.mozilla.org/projects/seamonkey/ SeaMonkey], [http://www.mozilla.org/products/mozilla1.x/ Mozilla Suite], [http://www.flock.com/ Flock] and [http://browser.netscape.com/ Netscape].
*There was a beta version of PasswordMaker for Internet Explorer 6 and 7, but it was never finished, and is [http://forums.passwordmaker.org/index.php/topic,884.0.html no longer maintained]. It is highly unlikely that there will be any further development on it, unless a sponsor steps forward. If you are interested in sponsoring the Internet Explorer version, please feel free to post a message on the [http://forums.passwordmaker.org/ user forums] and someone will get in touch with you to see if an arrangement can be made.
*There is an [http://passwordmaker.org/passwordmaker.html online version] that works with all browsers (including Internet Explorer and Opera) on all platforms.
*The desktop version is written in [http://trolltech.com QT/C++] and works on [http://www.windows.com Windows], [http://www.apple.com Mac], and Linux/Unix (Actually, any place that QT can be compiled on). The [http://forums.passwordmaker.org/index.php/topic,1376.msg1280429.html#msg1280429 J2ME version] will work on any Java-enabled mobile phone or PDA.

=== If someone gets my master password, can't he determine all of my generated passwords? ===

No. There are ten other variables he would need for each account. They are:
* URL
* character set
* which of nine hash algorithms was used
* modifier (if any)
* username (if any)
* password length
* password prefix (if any)
* password suffix (if any)
* which of nine l33t-speak levels was used
* when l33t-speak was applied (if at all)
Probably the most interesting of these is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

=== Can someone "unscramble" my generated passwords to determine my master password? ===

This is a common complaint heard about hashed-based password systems (for example, see page two of [http://passwordmaker.org/jhalderman.pdf A Convenient Method for Securely Managing Passwords]). The complaint simply doesn't hold water with PasswordMaker because PasswordMaker adds nine other variables not used in the traditional password=master+url formula. Those nine variables create an enormous search space which would take thousands of years to search, even using a distributed network of one million modern PCs. The nine variables are:
* character set
* which of nine hash algorithms was used
* modifier (if any)
* username (if any)
* password length
* password prefix (if any)
* password suffix (if any)
* which of nine l33t-speak levels was used
* when l33t-speak was applied (if at all)
Of course, the URLs of the sites must also be known since they are used in password calculation. Probably the most interesting of these variables is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

=== How do the account-settings and algorithm I choose work together to generate passwords? ===

If you've selected a non-HMAC hash function (those without the HMAC prefix), passwords are generated using the following pseudocode:

password = mp + usingURL + username + modifier<br>
password = leet(password, leetlevel) [optional]<br>
password = hash(password, charset)<br>
password = leet(password, leetlevel) [optional]<br>
password = truncate(prefix + password, length-suffix_length) + suffix<br>
password = truncate(password, length)

If you've selected an HMAC hash function (those with the HMAC prefix), passwords are generated using the following pseudocode:

data = usingURL + username + modifier<br>
mp = leet(mp, leetlevel) [optional]<br>
data = leet(data, leetlevel) [optional]<br>
password = hmac_hash(mp, data, charset)<br>
password = leet(password, leetlevel) [optional]<br>
password = truncate(prefix + password, length-suffix_length) + suffix<br>
truncate(password, length)

Where + is the concatenation operator. mp is the master password, usingURL is the value in "Using URL", and username, counter, prefix, and suffix are optional settings specified in the Account Settings dialog. For HMAC hash functions, mp is the secret key and data is the input text.

=== Where is my master password stored? ===

Nowhere, unless you choose the option Store Master Password on disk and in memory (encrypted). If you choose this option, your master password is stored using 256-bit strong encryption in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, [http://kb.mozillazine.org/Profile_folder look here]. For further protection you can instruct your operating system to encrypt passwordmaker.rdf. Instructions on how to do this with Windows XP/2000/NT are [http://support.microsoft.com/kb/307877/EN-US/ here]. Instructions for Mac OS/X Tiger are [http://www.apple.com/macosx/features/filevault/ here].

=== Where are the generated passwords stored? ===

Nowhere. The generated passwords are calculated on-the-fly as they are needed. The RAM used to store and calculate the generated passwords is proactively cleared to prevent passwords from being stored in a swap file/virtual memory/paging file.

=== How do I know PasswordMaker isn't sending my passwords to you without my knowledge? ===

Although you can read the source code to determine this for yourself, there's an easier way. Install a packet sniffer and use PasswordMaker to generate some passwords. You won't see any traffic to or from PasswordMaker -- ever. It never connects to the internet. Two popular packet sniffers are [http://www.snort.org/ snort] (for Unix/Linux/OSX) and [http://www.lazydogutilities.com/ipprev.htm ipInterceptor] (for Windows). Both tools reveal *all* network traffic, not just HTTP.

Another way would be if you have a two-way firewall installed. PasswordMaker will never trigger an outbound connection notification from your firewall (although it may trigger an inter-application process notification, depending on the firewall in use).

=== If I don't want to change all of my passwords, is PasswordMaker still a good choice? ===

Yes. PasswordMaker provides a secure method for encrypted storage of a specific, user-provided password for a custom Account. This way you can take advantage of PasswordMaker's other features (such as form completion) while still choosing your own passwords.

To set up a URL/site in this manner, simply go to the login page for the Account that you want to save the password for, create a new (or open the existing) Account for this URL/site, change to ''Advanced Options'' (if you are not already there), click the ''Advanced Auto-Populate'' tab, click '''<u>inside</u>''' the '''password''' field on the login page, click inside the ''Field Value'' field, enter your current password, then click the <i>Add></i> button (just above the list-box for fields), and last but not least, if desired, check ''Auto-populate username and password fields for sites that contain this URL''.

=== Which hash algorithms are supported? ===

* MD4
* HMAC-MD4
* MD5
* MD5 (for PasswordMaker v 0.6)
* HMAC-MD5
* HMAC-MD5 (for PasswordMaker v 0.6)
* SHA-1
* HMAC-SHA-1
* SHA-256
* HMAC-SHA-256
* HMAC-SHA-256 (for PasswordMaker v 1.5.1)
* RIPEMD-160
* HMAC-RIPEMD-160

=== Which hash algorithm should I use? ===

All of the algorithms are cryptographically strong, but of the algorithms PasswordMaker offers, many people regard SHA-256, HMAC-SHA1, HMAC-MD5 and HMAC-SHA-256 as the strongest.

=== What about recent press concerning MD5 AND SHA-1 "cracks"? ===

At Crypto 2004, Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu announced [http://eprint.iacr.org/2004/199.pdf they had found hash collisions] for MD4, MD5, RIPEMD, and HAVAL-128. SHA-1 hash collisions have also been announced. A [http://en.wikipedia.org/wiki/Hash_collision hash collision] means the researchers found two or more messages that yield the same hash with these algorithms. However, it's important to note that the one-way nature of these algorithms has not been undermined. In other words, in the context of PasswordMaker, [http://en.wikipedia.org/wiki/Hash_collision hash collisions] do not empower someone with the ability to derive your master password if they have your generated (hashed) passwords. The hash collision attacks have no relevance to PasswordMaker except there is very small chance someone could choose a different master password than yours which hashes to the same generated password. However, he would still need your username and the URL in order to hack your account.

=== Do you provide technical support? ===

Yes! Free technical support is provided on the [http://forums.passwordmaker.org/ user forums], with a response time often measured in minutes, but typically never more than 24 hours.

=== Where can I find an explanation of each and every feature and function? ===

Right here!

=== Do you accept Feature Requests? ===

Yes, absolutely! Feature requests from people who actually use PasswordMaker is one of the reasons PasswordMaker has a lot of the functionality it now has!

Our [http://forums.passwordmaker.org user forums] are the best place to get support, and the [http://forums.passwordmaker.org/index.php/topic,167.msg521113.html#msg521113 Feature Request List] is the place to make your desires known.

Please read through all of the existing [http://forums.passwordmaker.org/index.php/topic,167.msg521113.html#msg521113 Feature Requests] before posting, because it is very possible that someone else has already done it for you. If so, then by all means post a request to add your vote to it, and any other Feature Requests that sound attractive to you.

Each registered user gets 5 votes, so please feel free to stop by and add your votes now!

=== How is PasswordMaker licensed? ===

PasswordMaker is licensed under the [http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html LGPL] Open Source License. The desktop edition (because of QT) is licensed under the [http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GPL] Open Source License.

The full sources for PasswordMaker can be downloaded from [http://sourceforge.net/projects/passwordmaker here].

=== What if my computer crashed, and I have to start over from scratch? ===

Well, as long as you plan ahead and take a few simple precautions, this will not be a problem.

A more involved discussion of this issue is discussed in this [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Tips&Tricks#Super_Security_Tip|<b><u>Super
Security Tip</u></b>]], but for this one single question, it boils down to just understanding how PasswordMaker works, and working out a simple system for how to use it that you can easily remember. In short:

1. Figure out how you want to Group your accounts. It is recommended to keep your high-security accounts (e.g., financial) in a separate Group or Groups,

2. Create a 'template' Account in each Group, that has the Settings configured the way you want for those Accounts, and 'Copy Account' to create a new Account in that Group with the correct settings already configured, and

3. Modify the Defaults settings, and the settings your Group Template Accounts mentioned in #2 above, in such a way that would be difficult to guess how you had modified them, but easily reproducible by you if it became necessary.

A little thoughtful planning will go a long way.

=== What if I forget my Master Password? ===

You're out of luck... so don't forget it.

Seriously, since this password is not stored anywhere (unless you have told it to do so), there is nothing to recover - at least until Eric adds the 'Recover Password from Organic Memory' option...

There is, however, one exception to this rule...

If you have stored your Master Password on Disk, it is possible to discover it by doing the following:

* open a web page to the following link:
http://passwordmaker.org/decrypt.html
* find/open your RDF file,
* find the 'globalSettings' section,
* one at a time, copy/paste the values from the two following lines:

NS1:masterPassword="CopyWhateverIsHere"<br>
NS1:masterPasswordKey="AndHereToo"

into the appropriate boxes on the page you opened, then click the 'Decrypt' button.

The Master Password that is stored on disk will be revealed in the 'Decrypted Master Password' box.

== Firefox / Gecko edition ==

=== Where is account information and other settings stored? ===

Everything is stored in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, look [http://kb.mozillazine.org/Profile_folder here].

=== How does PasswordMaker defeat keyloggers? ===

Keyloggers work by tracing every key typed on the keyboard. With PasswordMaker, you never type anything but your master password (and if you choose <i>Store Master Password on disk and in memory (encrypted)</i>, you only type that <b>once</b>). The <b>real</b> passwords (generated ones) are never typed, so keyloggers never detect them!

=== How does PasswordMaker defeat phishing attacks? ===

Most phishing attacks occur when you navigate to a URL which appears to be that of a site that you trust, but actually is owned by an attacker. For example, you might navigate to http://www.bc1.lu/ instead of the Bank of Luxembourg's legitimate URL, http://www.bcl.lu/. The only difference between these two URLs is the lower-case letter <b>L</b> (used by the legitimate site) and the number <b>1</b> (used by the deceptive site). The attacker's intent is to get you to enter your username/password credentials on his deceptive site. He can then use those credentials on the legitimite site to do nefarious things.

If you use PasswordMaker, you'll be safe and secure. This is because the password it generates is based on the URL to which you've navigated. The password generated at a deceptive site is completely different than the one generated at a legitimite site (because their URLs differ, even if by one character). You might still be fooled into thinking http://www.bc1.lu/ is the Bank of Luxembourg, but the attacker will get the wrong password if you use PasswordMaker.

=== I want to use the same password for more than one site. Is this possible? ===

Yes! Let's suppose you want a Yahoo! account to use the same password as a gMail account. Go to the <i>Advanced Options</i> dialog and create a new account. Click on the <b>URLs</b> tab, and add a second pattern that will match the gMail login URL - in fact, you can add as many patterns as you want to match for this account, and they will all use the same password! The only caveat to this is, if they have different usernames, PasswordMaker won't be able to automatically populate the usernames for you, because you can only define one username per account - but if they all share the same username, PasswordMaker will populate everything automatically for you for all of them. That's it!

=== Can PasswordMaker accommodate sites that force me to change passwords periodically? ===

Yes! Go to the Advanced Options dialog and create a new account. In the <i>When URL Contains</i> field, type <b>mybank.com</b>. In the <i>Use the following text...</i> field, type <b>'mybank.com'</b>. In the <i>Modifier</i> field, type any text (such as a date or number) that you wish to change over time. For instance, you could type <b>September 2007</b>. When October comes and the bank expires your password, simply change the Counter to <b>October 2007</b>. You might instead choose to use an incrementing number. For example, <b>1</b> for this month, <b>2</b> for the next month, etc. Any text that you enter in the <i>Counter</i> field will vary the password.

=== Why doesn't PasswordMaker fill in the username on a site? ===

Each site can use a different label for identifying the username field, and not all can be found. Currently the best way to handle this is to use the ''Advanced Auto-Populate'' tab.

=== Can I share my settings between multiple computers? ===

PasswordMaker has "Export Settings" and "Import Settings" options, as well as the ability to upload/download your RDF file to/from an FTP site.

Exporting the settings saves them to a file (with the option to include/exclude the master password in encrypted form), while importing settings takes a file and imports its contents as if you'd manually entered them. You can synchronize two or more PCs this way.

There are plans to optionally save this file on an FTP site so you don't need to transport it across PCs, but you can always opt-out of this. In the meantime, you can store exported settings centrally somewhere yourself (like your web-based email account) to make it easy to import them from anywhere.

=== How can I change PasswordMaker's shortcuts (ctrl-` and alt-`) to something else? ===

Install the [http://mozilla.dorando.at/keyconfig.xpi KeyConfig Extension]. Scroll down to the PasswordMaker entry and change the shortcuts to anything you like. Changes won't take effect until you restart Firefox/Mozilla.

=== How can I turn off the toolbar icons for Mozilla and Netscape? ===

You can turn it off (and back on again) by creating the new boolean preferences browser.toolbars.showbutton.passwordmaker and browser.toolbars.showbutton.passwordmaker-key in about:config or user.js with the value of true or false. Make sure to restart all browsers after making the change.

=== How do I uninstall PasswordMaker? ===

If you're using Firefox, it's quite simple. Select Tools -> Extensions, select PasswordMaker and click the Uninstall button.

If you're using Mozilla or Netscape, it's as simple as deleting two files and one directory:

* If you installed PasswordMaker to a profile, locate that profile's directory (read this if you don't know how to find it). If you installed PasswordMaker to the browser directory, locate your Mozilla or Netscape installation directory (read [http://kb.mozillazine.org/Profile_folder this] if you don't know how to find it).If you don't know where you installed PasswordMaker, try to remember how you answered this prompt when installation began:
[[Image:mozilla-install.jpg]]

The rest of these directions refer to the path you've identified as path.

* Delete the file /path/chrome.rdf. This file is automatically regenerated the next time you start Mozilla or Netscape.
* Delete the file /path/chrome/passwdmaker.jar
* Delete the directory /path/chrome/overlayinfo. This directory is automatically recreated the next time you start Mozilla or Netscape. If you restart and this directory hasn't been recreated, don't worry: it just means you don't have any other extensions, themes, or skins installed.

== Desktop edition ==

== Javascript edition ==

== Yahoo! Widget edition ==

== Command-line edition ==

== PHP / Mobile edition ==

== On-line edition ==

F.A.Q.

2009-04-25T20:11:10Z

Tanstaafl: /* What if I forget my Master Password? */

== General ==

=== What browsers/platforms are supported? ===

*The extension works with some of the most popular [http://en.wikipedia.org/wiki/Gecko_(layout_engine) Gecko] based web browsers, including: [http://www.mozilla.com/en-US/firefox/ Firefox], [http://www.mozilla.org/projects/seamonkey/ SeaMonkey], [http://www.mozilla.org/products/mozilla1.x/ Mozilla Suite], [http://www.flock.com/ Flock] and [http://browser.netscape.com/ Netscape].
*There was a beta version of PasswordMaker for Internet Explorer 6 and 7, but it was never finished, and is [http://forums.passwordmaker.org/index.php/topic,884.0.html no longer maintained]. It is highly unlikely that there will be any further development on it, unless a sponsor steps forward. If you are interested in sponsoring the Internet Explorer version, please feel free to post a message on the [http://forums.passwordmaker.org/ user forums] and someone will get in touch with you to see if an arrangement can be made.
*There is an [http://passwordmaker.org/passwordmaker.html online version] that works with all browsers (including Internet Explorer and Opera) on all platforms.
*The desktop version is written in [http://trolltech.com QT/C++] and works on [http://www.windows.com Windows], [http://www.apple.com Mac], and Linux/Unix (Actually, any place that QT can be compiled on). The [http://forums.passwordmaker.org/index.php/topic,1376.msg1280429.html#msg1280429 J2ME version] will work on any Java-enabled mobile phone or PDA.

=== If someone gets my master password, can't he determine all of my generated passwords? ===

No. There are ten other variables he would need for each account. They are:
* URL
* character set
* which of nine hash algorithms was used
* modifier (if any)
* username (if any)
* password length
* password prefix (if any)
* password suffix (if any)
* which of nine l33t-speak levels was used
* when l33t-speak was applied (if at all)
Probably the most interesting of these is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

=== Can someone "unscramble" my generated passwords to determine my master password? ===

This is a common complaint heard about hashed-based password systems (for example, see page two of [http://passwordmaker.org/jhalderman.pdf A Convenient Method for Securely Managing Passwords]). The complaint simply doesn't hold water with PasswordMaker because PasswordMaker adds nine other variables not used in the traditional password=master+url formula. Those nine variables create an enormous search space which would take thousands of years to search, even using a distributed network of one million modern PCs. The nine variables are:
* character set
* which of nine hash algorithms was used
* modifier (if any)
* username (if any)
* password length
* password prefix (if any)
* password suffix (if any)
* which of nine l33t-speak levels was used
* when l33t-speak was applied (if at all)
Of course, the URLs of the sites must also be known since they are used in password calculation. Probably the most interesting of these variables is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

=== How do the account-settings and algorithm I choose work together to generate passwords? ===

If you've selected a non-HMAC hash function (those without the HMAC prefix), passwords are generated using the following pseudocode:

password = mp + usingURL + username + modifier<br>
password = leet(password, leetlevel) [optional]<br>
password = hash(password, charset)<br>
password = leet(password, leetlevel) [optional]<br>
password = truncate(prefix + password, length-suffix_length) + suffix<br>
password = truncate(password, length)

If you've selected an HMAC hash function (those with the HMAC prefix), passwords are generated using the following pseudocode:

data = usingURL + username + modifier<br>
mp = leet(mp, leetlevel) [optional]<br>
data = leet(data, leetlevel) [optional]<br>
password = hmac_hash(mp, data, charset)<br>
password = leet(password, leetlevel) [optional]<br>
password = truncate(prefix + password, length-suffix_length) + suffix<br>
truncate(password, length)

Where + is the concatenation operator. mp is the master password, usingURL is the value in "Using URL", and username, counter, prefix, and suffix are optional settings specified in the Account Settings dialog. For HMAC hash functions, mp is the secret key and data is the input text.

=== Where is my master password stored? ===

Nowhere, unless you choose the option Store Master Password on disk and in memory (encrypted). If you choose this option, your master password is stored using 256-bit strong encryption in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, [http://kb.mozillazine.org/Profile_folder look here]. For further protection you can instruct your operating system to encrypt passwordmaker.rdf. Instructions on how to do this with Windows XP/2000/NT are [http://support.microsoft.com/kb/307877/EN-US/ here]. Instructions for Mac OS/X Tiger are [http://www.apple.com/macosx/features/filevault/ here].

=== Where are the generated passwords stored? ===

Nowhere. The generated passwords are calculated on-the-fly as they are needed. The RAM used to store and calculate the generated passwords is proactively cleared to prevent passwords from being stored in a swap file/virtual memory/paging file.

=== How do I know PasswordMaker isn't sending my passwords to you without my knowledge? ===

Although you can read the source code to determine this for yourself, there's an easier way. Install a packet sniffer and use PasswordMaker to generate some passwords. You won't see any traffic to or from PasswordMaker -- ever. It never connects to the internet. Two popular packet sniffers are [http://www.snort.org/ snort] (for Unix/Linux/OSX) and [http://www.lazydogutilities.com/ipprev.htm ipInterceptor] (for Windows). Both tools reveal *all* network traffic, not just HTTP.

Another way would be if you have a two-way firewall installed. PasswordMaker will never trigger an outbound connection notification from your firewall (although it may trigger an inter-application process notification, depending on the firewall in use).

=== If I don't want to change all of my passwords, is PasswordMaker still a good choice? ===

Yes. PasswordMaker provides a secure method for encrypted storage of a specific, user-provided password for a custom Account. This way you can take advantage of PasswordMaker's other features (such as form completion) while still choosing your own passwords.

To set up a URL/site in this manner, simply go to the login page for the Account that you want to save the password for, create a new (or open the existing) Account for this URL/site, change to ''Advanced Options'' (if you are not already there), click the ''Advanced Auto-Populate'' tab, click '''<u>inside</u>''' the '''password''' field on the login page, click inside the ''Field Value'' field, enter your current password, then click the <i>Add></i> button (just above the list-box for fields), and last but not least, if desired, check ''Auto-populate username and password fields for sites that contain this URL''.

=== Which hash algorithms are supported? ===

* MD4
* HMAC-MD4
* MD5
* MD5 (for PasswordMaker v 0.6)
* HMAC-MD5
* HMAC-MD5 (for PasswordMaker v 0.6)
* SHA-1
* HMAC-SHA-1
* SHA-256
* HMAC-SHA-256
* HMAC-SHA-256 (for PasswordMaker v 1.5.1)
* RIPEMD-160
* HMAC-RIPEMD-160

=== Which hash algorithm should I use? ===

All of the algorithms are cryptographically strong, but of the algorithms PasswordMaker offers, many people regard SHA-256, HMAC-SHA1, HMAC-MD5 and HMAC-SHA-256 as the strongest.

=== What about recent press concerning MD5 AND SHA-1 "cracks"? ===

At Crypto 2004, Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu announced [http://eprint.iacr.org/2004/199.pdf they had found hash collisions] for MD4, MD5, RIPEMD, and HAVAL-128. SHA-1 hash collisions have also been announced. A [http://en.wikipedia.org/wiki/Hash_collision hash collision] means the researchers found two or more messages that yield the same hash with these algorithms. However, it's important to note that the one-way nature of these algorithms has not been undermined. In other words, in the context of PasswordMaker, [http://en.wikipedia.org/wiki/Hash_collision hash collisions] do not empower someone with the ability to derive your master password if they have your generated (hashed) passwords. The hash collision attacks have no relevance to PasswordMaker except there is very small chance someone could choose a different master password than yours which hashes to the same generated password. However, he would still need your username and the URL in order to hack your account.

=== Do you provide technical support? ===

Yes! Free technical support is provided on the [http://forums.passwordmaker.org/ user forums], with a response time often measured in minutes, but typically never more than 24 hours.

=== Where can I find an explanation of each and every feature and function? ===

Right here!

=== Do you accept Feature Requests? ===

Yes, absolutely! Feature requests from people who actually use PasswordMaker is one of the reasons PasswordMaker has a lot of the functionality it now has!

Our [http://forums.passwordmaker.org user forums] are the best place to get support, and the [http://forums.passwordmaker.org/index.php/topic,167.msg521113.html#msg521113 Feature Request List] is the place to make your desires known.

Please read through all of the existing [http://forums.passwordmaker.org/index.php/topic,167.msg521113.html#msg521113 Feature Requests] before posting, because it is very possible that someone else has already done it for you. If so, then by all means post a request to add your vote to it, and any other Feature Requests that sound attractive to you.

Each registered user gets 5 votes, so please feel free to stop by and add your votes now!

=== How is PasswordMaker licensed? ===

PasswordMaker is licensed under the [http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html LGPL] Open Source License. The desktop edition (because of QT) is licensed under the [http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GPL] Open Source License.

The full sources for PasswordMaker can be downloaded from [http://sourceforge.net/projects/passwordmaker here].

=== What if my computer crashed, and I have to start over from scratch? ===

Well, as long as you plan ahead and take a few simple precautions, this will not be a problem.

A more involved discussion of this issue is discussed in this [[Firefox/Mozilla/SeaMonkey/Flock/Netscape/Tips&Tricks#Super_Security_Tip|<b><u>Super
Security Tip</u></b>]], but for this one single question, it boils down to just understanding how PasswordMaker works, and working out a simple system for how to use it that you can easily remember. In short:

1. Figure out how you want to Group your accounts. It is recommended to keep your high-security accounts (e.g., financial) in a separate Group or Groups,

2. Create a 'template' Account in each Group, that has the Settings configured the way you want for those Accounts, and 'Copy Account' to create a new Account in that Group with the correct settings already configured, and

3. Modify the Defaults settings, and the settings your Group Template Accounts mentioned in #2 above, in such a way that would be difficult to guess how you had modified them, but easily reproducible by you if it became necessary.

A little thoughtful planning will go a long way.

=== What if I forget my Master Password? ===

You're out of luck... so don't forget it.

Seriously, since this password is not stored anywhere (unless you have told it to do so), there is nothing to recover - at least until Eric adds the 'Recover Password from Organic Memory' option...

There is, however, one exception to this rule...

If you have stored your Master Password on Disk, it is possible to discover it by going the following:

* open a web page to the following link:
http://passwordmaker.org/decrypt.html
* find/open your RDF file,
* find the 'globalSettings' section,
* one at a time, copy/paste the values from the two following lines:

NS1:masterPassword="CopyWhateverIsHere"<br>
NS1:masterPasswordKey="AndHereToo"

into the appropriate boxes on the page you opened, then click the 'Decrypt' button.

The Master Password that is stored on disk will be revealed in the 'Decrypted Master Password' box.

== Firefox / Gecko edition ==

=== Where is account information and other settings stored? ===

Everything is stored in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, look [http://kb.mozillazine.org/Profile_folder here].

=== How does PasswordMaker defeat keyloggers? ===

Keyloggers work by tracing every key typed on the keyboard. With PasswordMaker, you never type anything but your master password (and if you choose <i>Store Master Password on disk and in memory (encrypted)</i>, you only type that <b>once</b>). The <b>real</b> passwords (generated ones) are never typed, so keyloggers never detect them!

=== How does PasswordMaker defeat phishing attacks? ===

Most phishing attacks occur when you navigate to a URL which appears to be that of a site that you trust, but actually is owned by an attacker. For example, you might navigate to http://www.bc1.lu/ instead of the Bank of Luxembourg's legitimate URL, http://www.bcl.lu/. The only difference between these two URLs is the lower-case letter <b>L</b> (used by the legitimate site) and the number <b>1</b> (used by the deceptive site). The attacker's intent is to get you to enter your username/password credentials on his deceptive site. He can then use those credentials on the legitimite site to do nefarious things.

If you use PasswordMaker, you'll be safe and secure. This is because the password it generates is based on the URL to which you've navigated. The password generated at a deceptive site is completely different than the one generated at a legitimite site (because their URLs differ, even if by one character). You might still be fooled into thinking http://www.bc1.lu/ is the Bank of Luxembourg, but the attacker will get the wrong password if you use PasswordMaker.

=== I want to use the same password for more than one site. Is this possible? ===

Yes! Let's suppose you want a Yahoo! account to use the same password as a gMail account. Go to the <i>Advanced Options</i> dialog and create a new account. Click on the <b>URLs</b> tab, and add a second pattern that will match the gMail login URL - in fact, you can add as many patterns as you want to match for this account, and they will all use the same password! The only caveat to this is, if they have different usernames, PasswordMaker won't be able to automatically populate the usernames for you, because you can only define one username per account - but if they all share the same username, PasswordMaker will populate everything automatically for you for all of them. That's it!

=== Can PasswordMaker accommodate sites that force me to change passwords periodically? ===

Yes! Go to the Advanced Options dialog and create a new account. In the <i>When URL Contains</i> field, type <b>mybank.com</b>. In the <i>Use the following text...</i> field, type <b>'mybank.com'</b>. In the <i>Modifier</i> field, type any text (such as a date or number) that you wish to change over time. For instance, you could type <b>September 2007</b>. When October comes and the bank expires your password, simply change the Counter to <b>October 2007</b>. You might instead choose to use an incrementing number. For example, <b>1</b> for this month, <b>2</b> for the next month, etc. Any text that you enter in the <i>Counter</i> field will vary the password.

=== Why doesn't PasswordMaker fill in the username on a site? ===

Each site can use a different label for identifying the username field, and not all can be found. Currently the best way to handle this is to use the ''Advanced Auto-Populate'' tab.

=== Can I share my settings between multiple computers? ===

PasswordMaker has "Export Settings" and "Import Settings" options, as well as the ability to upload/download your RDF file to/from an FTP site.

Exporting the settings saves them to a file (with the option to include/exclude the master password in encrypted form), while importing settings takes a file and imports its contents as if you'd manually entered them. You can synchronize two or more PCs this way.

There are plans to optionally save this file on an FTP site so you don't need to transport it across PCs, but you can always opt-out of this. In the meantime, you can store exported settings centrally somewhere yourself (like your web-based email account) to make it easy to import them from anywhere.

=== How can I change PasswordMaker's shortcuts (ctrl-` and alt-`) to something else? ===

Install the [http://mozilla.dorando.at/keyconfig.xpi KeyConfig Extension]. Scroll down to the PasswordMaker entry and change the shortcuts to anything you like. Changes won't take effect until you restart Firefox/Mozilla.

=== How can I turn off the toolbar icons for Mozilla and Netscape? ===

You can turn it off (and back on again) by creating the new boolean preferences browser.toolbars.showbutton.passwordmaker and browser.toolbars.showbutton.passwordmaker-key in about:config or user.js with the value of true or false. Make sure to restart all browsers after making the change.

=== How do I uninstall PasswordMaker? ===

If you're using Firefox, it's quite simple. Select Tools -> Extensions, select PasswordMaker and click the Uninstall button.

If you're using Mozilla or Netscape, it's as simple as deleting two files and one directory:

* If you installed PasswordMaker to a profile, locate that profile's directory (read this if you don't know how to find it). If you installed PasswordMaker to the browser directory, locate your Mozilla or Netscape installation directory (read [http://kb.mozillazine.org/Profile_folder this] if you don't know how to find it).If you don't know where you installed PasswordMaker, try to remember how you answered this prompt when installation began:
[[Image:mozilla-install.jpg]]

The rest of these directions refer to the path you've identified as path.

* Delete the file /path/chrome.rdf. This file is automatically regenerated the next time you start Mozilla or Netscape.
* Delete the file /path/chrome/passwdmaker.jar
* Delete the directory /path/chrome/overlayinfo. This directory is automatically recreated the next time you start Mozilla or Netscape. If you restart and this directory hasn't been recreated, don't worry: it just means you don't have any other extensions, themes, or skins installed.

== Desktop edition ==

== Javascript edition ==

== Yahoo! Widget edition ==

== Command-line edition ==

== PHP / Mobile edition ==

== On-line edition ==

Introduction

2009-04-03T11:03:09Z

Tanstaafl: Protected "Introduction": It was hacked... [edit=autoconfirmed:move=autoconfirmed]

==The Problem==

With the proliferation of online resources these days, you probably have many different usernames and passwords that you have to remember: banks, investment accounts, bill pay systems, credit card sites, email accounts, instant messenger accounts, photo sites, blogging tools - and countless others - all require a username and password to be able to access them. If you're like most people, you probably have only a few - or maybe just one or two - simple passwords you use for all of your accounts, because it's easier to remember just one or two than it is dozens. To make matters worse, the one or two passwords that you do use are probably fairly simple, like your dog's name, your birthday, or your spouse or child's name. The problem is, this is '''''incredibly risky'''''.

Maybe you do use unique passwords, and get around the problem of remembering them by saving them in your browser, or storing them in a spreadsheet or other file - which is very insecure - or even writing/printing them on a piece of paper and taping it to your computer display. Maybe you even use one of the many [http://en.wikipedia.org/wiki/Password_manager password managers] that are available. But now you've centralized your passwords and access to them becomes difficult while at work, a friend's, or a public internet terminal. You can't get to your passwords without carrying them around or [http://www.passwordsafe.com/ publishing them on the internet]. Some people even carry a USB keychain with their passwords wherever they go. How inconvenient. And [http://www.passwordsafe.com/ publishing them on the internet?] Yikes! We need not even mention the security risks inherent with that solution. Even if you trust the company storing the passwords, you can be sure every cracker in the world is drooling over the prospect of accessing their database.

Ideally, you should use a unique, [http://en.wikipedia.org/wiki/Password_strength#Strong_passwords strong password] for each of your accounts - especially the ones that contain sensitive information, like your bank or your investment brokerage account - but what about all of your other accounts? They may not contain information that is quite as sensitive as your bank, but it is still your private information, and none of anyone else's business.

"But only a genius could memorize so many unique passwords!", you say? Well, read on...

== The Solution ==

What if you could use passwords that are as unique as fingerprints for each and every one of your accounts, yet not have to remember them? PasswordMaker allows you to do just that. By using complex mathematical formulae, called [http://en.wikipedia.org/wiki/Hash_function hashing algorithms], PasswordMaker outputs the same unique passwords for you each and every time, provided you give it the same input. And these passwords ''are unique'' across the globe (providing they are of sufficient length).

Don't write them down on sticky notes for others to find; no, PasswordMaker calculates them for you over and over again -- as needed -- without storing them so they can't be stolen. And if you use more than one computer (for example, one at work and one at home), it's child's play to synchronize them. There's even an [http://passwordmaker.sourceforge.net/passwordmaker.html on-line version] for times when you are at a public computer and can't install any software.

----

The old PasswordMaker website can be found [http://passwordmaker.sourceforge.net/ here]. Please note it is no longer maintained but is present for archival purposes.

Introduction

2009-04-03T11:02:11Z

Tanstaafl: Reverted edits by 85.110.89.225 (Talk); changed back to last version by Miquelfire

Talk:Introduction

2009-03-24T18:57:08Z

Tanstaafl:

Firefox/Mozilla/SeaMonkey/Flock/Netscape/Advanced

2009-02-26T14:57:58Z

Tanstaafl:

==Advanced Options: Accounts Tab==

[[Image:Advanced_options-1+.png|Accounts Tab]]

The left side of the ''Advanced Options'' window is identical to the Basic Options dialog, with the exception/addition of the 'Master Password Hash' feature.

===1. Menus===

The functionality provided by the menus is easily ascertained by simply looking at them, but the most important to note is the ''File'' menu, that allows you to:
* Import Settings
* Export Settings
* Print Settings
When Printing your ''settings'', you have the option of including the ''generated passwords'' for your local and remote accounts, but be aware - you will be prompted for your ''master password'' for each and every ''account'', so if you have a lot, this could be time-consuming and confusing.

'''ToDo:''' This dialog/process needs a 'Cancel' option...

===2. Master Password Hash===

The ability to store the ''master password hash'' is a powerful and convenient feature that allows you to verify that the ''master password'' you enter when prompted via the ''master password prompt'' pop-up window is the same one that was used when you generated the ''password'' for the account in question. Here is how it works:

'''ToDo:''' Add ''how it works'' here

The fact that you can enter the '''wrong''' ''master password'' is actually indicative of a very subtle yet powerful feature of PasswordMaker that you may not yet have grasped:
* '''there is nothing preventing you from using more than one ''master password'' '''
Using more than one ''master password'' can add greatly to the security provided by PasswordMaker, but doing so also adds a level of complexity that can be confusing. If you choose to do this, you should take some time and define precisely how you will implement it. See '''[[Firefox_/_Gecko#Multiple_Master_Passwords_How-to|this tip]]''' for a scenario that will clarify this issue, and will enable you to easily create your own, unique method.

* "I use more than one master password" - Because of the way PasswordMaker works, a mechanism for dealing with whether or not you are using a single ''master password'' had to be provided, and is currently implemented with this option.

:Here is how it works:
<b>
:* If it is unchecked, PasswordMaker will use a 'global hash' for all accounts
:* If it is checked, PasswordMaker will use the account-specific hash, if it has been stored</b>

:PasswordMaker will not attempt to verify the master password if:
<b>
:* It is unchecked and the master password global hash has not been stored on disk (1.6 behavior), or
:* It is checked but the selected/triggered account has no hash stored on disk
</b>

:You can safely switch between the two 'modes' - meaning, you can safely check and uncheck this option - as doing so does not delete any of the Hashes that have been stored, e.g.:
:* if you uncheck this option after having saved some account specific ''master password'' hashes, and a Global Hash has been stored, it will be used instead of the ''account'' specific hash
:* if no Global Hash has been stored, it will do nothing
:* if you then re-enable this option, the individual Account Hashes that have been stored will again be used

* Hash status - This indicator simply tells you whether or not the ''master password hash'' has been stored for the selected ''account'' or not. The possible states, which should be self-evident, are:
::* Not stored on disk
::* Doesn't Match
::* Matches

'''Suggested ToDo:''' Simplify the GUI for this even further by changing it to this:<br>
[[Image:New_hash_gui.png]]<br>
The button label would be contextual - meaning, it would change between ''Store'' and ''Clear'', depending on whether the Selected Account has its ''master password hash'' already stored or not.

* Store / Clear Master Password Hash -

===3. Make Selection Selector===
<table><tr align="left"><td valign="top" width="600">
The ''select box'' allows you to work with your ''Groups'' and ''Accounts''. All of these actions are also available from the ''context menu''.

When the Accounts tab is selected, there are four buttons directly beneath the tabs. Initially, the only entry shown in the Name column is the Default Options account. The only two buttons that are activated/clickable are the New Group and the Settings buttons.<br>
'''New Group''' This button is used to set up a new group -- a container for accounts. When clicked, a dialog is displayed asking for the Folder/Group Name and description. Upon completion of this dialog, the newly-created folder is displayed in the Account Settings dialog along with its description (if one was supplied).<br>
'''New Account''' When a group is selected, the New Account button is activated/clickable. This button allows you to define custom password-generation settings for specific URLs that should be handled differently than all other ("default") URLs. When the button is pressed, a New Account entry is created and the [account-settings.xhtml Account-Specific Settings] dialog is displayed.<br>
'''Delete Selection''' As the name indicates, this button deletse the selected account or the selected group. Use caution here, however. If a group is deleted, all the accounts within that group are also deleted. You are prompted for confirmation before anything is deleted.<br>
'''Settings''' When the Settings button is pressed or an account is double-clicked, the PasswordMaker [account-settings.xhtml Account-Specific Settings] dialog is displayed. This dialog allows you to define custom password-generation settings for the selected account; for example, how long the password should be for your email account at gmail.com.</td>
<td valign="top">
[[Image:Make_selection.png]]
</td></tr></table>

===4. ''Defaults'' settings===

===5. Custom Account Group===

===6. Custom Account===

==Advanced Options: Global Settings Tab==

[[Image:advanced_options-2+.png|Global Settings Tab]]

Here you'll define settings which apply to all of PasswordMaker. Currently, there are seven checkboxes and one drop-down:

*1. Mask Generated Password - when checked, generated passwords are masked with asterisks so that they are not legible to the casual observer
*2. '''Hide Master Password Field (number of asterisks)''' This option causes the master password box to be completely concealed, thereby disabling the casual observer to determine the password length by counting asterisks
*3. Confirm ''master password'' by typing it twice -
*4. Show all passwords on web pages as clear text -
*5. Enable auto-complete on pages that disable it - (todo: describe why this is valuable)
*6. Auto-clear clipboard ''n'' seconds after copying it there - this security feature prevents you from having to remember to clear the clipboard of generated passwords. If checked, the clipboard is automatically cleared ''n'' seconds after pressing the Copy to Clipboard button, where ''n'' is the value entered in the associated input field. However, before clearing the clipboard, PasswordMaker checks that nothing else has been copied there since the generated password. If something has been copied there since then, the clipboard contents are not cleared. This prevents other data in the clipboard from being overwritten
*7. Show status-bar indicator -
*8. Action to take when coolkey (or ALT-`) is activated - the four options are:<br>
[[Image:Coolkey_actions.png|Coolkey Actions]]<br>
::1. ''Do nothing,'' which means ... do nothing
::2. ''Populate all fields,'' which means that all fields will be populated (todo: clearly PasswordMaker doesn't populate '''all''' fields, so describe this better)
::3. ''Populate empty fields only,'' which means that only empty password fields will be populated
::4. ''Clear all fields,'' which means all the fields on the web page will be cleared

==Advanced Options: Upload / Download Tab==

==Advanced Options: Special Domains Tab==

[[Image:button.jpg|l33t]]<br>
Some domains mandate the use of subdomains. The most common examples of this are [http://en.wikipedia.org/wiki/CcTLD ccTLD]s (country code top-level domains), such as .uk. A domain in .uk never exists without a [http://en.wikipedia.org/wiki/Second-level_domain SLD] (second-level domain), such as .co.uk.

Some domains even require third-level domains; for example, government departments in Australia must include a regional subdomain (e.g., .nsw for New South Wales) followed by .gov.au. In other words, government departments in New South Wales, Australia, must be in the .nsw.gov.au domain.

Finally, some countries issue domain names in both their ccTLD '''''and''''' in SLDs. Japan is an example: their ccTLD is .jp. They issue domains in both .jp and .co.jp. (see [http://jprs.jp/ http://jprs.jp] and [http://jprs.jp/ http://jprs.co.jp]).

With the myriad possibilities for required subdomains, PasswordMaker can't account for them all. It includes some common ones -- the list of which grows from release to release (the ''default'' list). However, you are free to add/remove your own using the '''Special Domains Dialog'''. Your customizations to the special domains list are exported when using the '''Export Preferences''' feature, and imported when using the '''Import Preferences''' feature (providing the file being imported contains special domains). In this way, you can easily transfer customized lists to other PasswordMaker installations.

==Advanced Options: URLs Tab==

PasswordMaker uses what are called URL patterns to detect when you are on a page for a particular account that you have specified.

'''<SPAN style="color: red;">Important</SPAN>''': The pattern(s) you define should be secure and specific enough to avoid false positives and prevent phishing attacks.

PasswordMaker supports two types of patterns: ''wildcard'' and ''regular expression''.

=====Wildcard Patterns=====

''Wildcards'' are pervasive throughout computing; you've most likely seen them before. The asterisk (<TT>*</TT>) represents zero or more characters and the question mark (<TT>?</TT>) any ''single'' character in the URL to match. In Unix, this is referred to as globbing. These wildcard characters are often used for matching filenames.<br>

Here are some examples:

<PRE>*.yahoo.com/*</PRE>

<table><tr align="left"><td valign="top" width="345">
'''Matches'''

Everything in Yahoo's domain
</td>
<td valign="top">

'''Non-Matches'''

http://mail.google.com/
</td></tr></table>

<PRE>*mail.yahoo.com*</PRE>

<table><tr align="left"><td valign="top" width="345">
'''Matches'''

http://mail.yahoo.com/
https://1.mail.yahoo.com.spoof.net/
http://mail.yahoo.com/clownshoes/
http://mail.yahoo.com/inbox/123.html
ftp://mail.yahoo.com
</td>
<td valign="top">

'''Non-Matches'''

http://maps.yahoo.com
</td></tr></table>

<PRE>http://??.wikipedia.org/wiki/Clown</PRE>

<table><tr align="left"><td valign="top" width="345">
'''Matches'''

http://en.wikipedia.org/wiki/Clown
http://de.wikipedia.org/wiki/Clown
http://cs.wikipedia.org/wiki/Clown
</td>
<td valign="top">

'''Non-Matches'''

https://en.wikipedia.org/wiki/Clown<br>
http://de.wikipedia.org/wiki/Clown/<br>
ftp://en.wikipedia.org/wiki/Clown<br>
</td></tr></table>

<PRE>http://digg.com/</PRE>

<table><tr align="left"><td valign="top" width="345">
'''Matches'''

http://digg.com/
</td>
<td valign="top">

'''Non-Matches'''

http://digg.com<br>
http://www.digg.com/
</td></tr></table>

<PRE>*://*.asimov.???/*</PRE>

<table><tr align="left"><td valign="top" width="345">
'''Matches'''

ftp://ftp.asimov.net/<br>
ftp://ftp.asimov.com/theory.html<br>
http://bear.asimov.net/mom/<br>
https://isaac.asimov.org/hercules<br>
gopher://asimov.net/
</td>
<td valign="top">

'''Non-Matches'''

ftp://ftp.asimov.co.uk<br>
http://isaac.home.com/tin.php
</td></tr></table>

<PRE>*</PRE>

<table><tr align="left"><td valign="top" width="345">
'''Matches'''

(Matches everything)
</td>
<td valign="top">

'''Non-Matches'''
</td></tr></table>

=====Regular Expression Patterns=====

''Regular expressions'' are also pervasive throughout computing, although they are sometimes considered an advanced topic. Regular expressions are like "wildcards on steroids" because they are more powerful and flexible, but their goal is similar to wildcards: define a means with which to match arbitrary text.

For those already familiar with regular expressions, PasswordMaker adheres to the [http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Guide:Regular_Expressions JavaScript 1.5 regular expression] syntax. When in doubt, refer to this guide. Do not surround regular expressions with forward slashes like this: /abc/
Further Reading

Entire books have been written about regular expressions, so rather than discuss them here, we refer you to some free, valuable on-line resources which teach everything you need to know about them. This list is by no means concise, and we have no affiliation with these resources.

* [http://www.regular-expressions.info/ Regular Expression Tutorial and Reference] - One of the most comprehensive, free regular expression tutorials on the net.
* [http://regexadvice.com/ RegexAdvice.com] - Forums and blogs dedicated to regular expressions.
* [http://www.regexlib.com/ Regular Expression Library] - Currently contains over 1000 expressions from contributors around the world.
* [http://etext.lib.virginia.edu/services/helpsheets/unix/regex.html Using Regular Expressions] - Brief introduction to regular expressions
* [http://regexlib.com/cheatsheet.aspx Regular Expression Cheat Sheet] - A one page printable reference for regular expressions
* [http://rudd-o.com/projects/wp-search-replace/wp-search-replace-regexptut/ Regular expressions: a short tutorial] - A five-minute tutorial on how to learn the most useful regular expressions
* [http://wiki.castlecops.com/A_list_of_Regex_topics A List of Regex Topics] - Wiki with various topics about regular expressions.
* [http://www.regex.info/ Mastering Regular Expressions] - Official website for Jeffrey Friedl's book.
* [http://www.regenechsen.de/phpwcms/index.php?regex_englisch Regenechsen] - Beginners regular expression tutorial with exercises.

Thanks, Wikipedia.

Of course, you can always ask for regular expression advice in the the [http://forums.passwordmaker.org PasswordMaker Forums].

==Advanced Options: Extended Tab==

*1. Username - blah blah

*2. Use l33t - blah blah

*3. Hash Algorithm - blah blah

*4. Password Length - blah blah

*5. Characters - blah blah

*6. Modifier - blah blah

*7. Password Prefix - blah blah

*8. Password Suffix - blah blah

Password Details simply shows the relative strength of the password (this algorithm could use some work), and displays the Generated Password - unless you have enabled the 'Mask Generated Passwords with Asterisks' Global Setting.

==Advanced Options: Advanced Auto-Populate Tab==

*1. Field Name - blah blah

*2. Field Value - blah blah

*3. Field ID - blah blah

*4. Field Type - blah blah

*5. Notes - blah blah

*6. Form Name - blah blah

*7. Notify option - blah blah

Once you have entered the Field Value and set the Field Type option, you must remember to click the 'Add' button, or it will not save the field/value.

==Context Menu==

==Menu==

2007-10-04T17:31:25Z

Tanstaafl: /* Password Change Procedure */

<table><tr align="left"><td valign="top" width="345">
__TOC__</td>
<td valign="top">
This edition of PasswordMaker is a small, lightweight, free (licensed under the [http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html LGPL] Open Source license), extension for many of the most popular [http://en.wikipedia.org/wiki/Gecko_(layout_engine) Gecko] based web browsers, including: [http://www.mozilla.com/en-US/firefox/ Firefox], [http://www.mozilla.org/projects/seamonkey/ SeaMonkey], [http://www.mozilla.org/products/mozilla1.x/ Mozilla Suite], [http://www.flock.com/ Flock] and [http://browser.netscape.com/ Netscape].

It creates unique, secure passwords that are very easy for you to retrieve, but no one else. Nothing is stored anywhere, anytime, so there's nothing to be hacked, lost, or stolen.

Much of the following information is applicable '''only''' to the 1.7.x versions of PasswordMaker. If you are using an older version, please [https://addons.mozilla.org/en-US/firefox/addon/469 upgrade], and then come back here to learn how to take advantage of all of the unique and powerful features PWM has to offer.

'''This page is in major flux, and will be changing rapidly over the next few days. Please do not attempt to edit this page until this notice is removed - which will be when all of the content has been updated, merged and migrated from the [http://passwordmaker.org website].'''
</td></tr></table>

==First Things First==

In order to prevent some of the most common errors - and to save you a lot of confusion and frustration - you are strongly encouraged to read this entire page, along with the [[Faq|FAQ]], at least once prior to attempting to use PasswordMaker.

===Precautions and Caveats===

PasswordMaker has two different 'modes' that it can operate in - ''Basic'', and ''Advanced''.

Using PasswordMaker in ''Basic'' mode (using only the ''Basic Options'') is very secure, and is the recommended way to start out, but there are certain things you should understand in order to avoid problems - the most common of which is locking yourself out of one of your online accounts.

With this in mind, it is best to:
*be sure that you have defined an alternate email address for any important accounts, so you will be able to 'reset' or 'recover' your password in the event that you lock yourself out (this is a good thing to do anyway, whether you use PasswordMaker or not)
*practice a few times on a throw away account, like gmail or yahoo - but the first recommendation still applies
*start out using PasswordMaker in ''Basic'' mode - but first learn the difference between ''Basic'' and ''Advanced'' modes so that you will know if/when you need to switch to the ''Advanced'' mode

'''Note:''' PasswordMaker is currently unable to populate ''Basic HTTP Auth'' pop-up prompts like this:<br>
[[Image:Basic_http_auth.png]]

===''Basic'' and ''Advanced'' Modes - Differences===

The main difference between the two modes is primarily one of complexity, in the form of the large number of configuration options. We will get into each in detail below, but for now:

*PasswordMaker uses the concept of ''Accounts'' to identify a group of ''settings'' that work together to generate a password

*'''In ''Basic'' mode''', there is only one ''account'' that matters (referred to as the ''Defaults account'') - so, only one group of ''settings'' (referred to as the ''Defaults settings''), that are applied to every site that you log into
- The main advantage of using only the ''Basic'' options is simplicity

*<b>In ''Advanced'' mode</b>
**you can create as many unique ''accounts'' as desired, each of which has its own ''settings'' that are applied only when that account is used
**you must define the URL(s) that identify each account
**you can define <b>multiple</b> URLs for any given ''account'', which means:
***PasswordMaker will use the same ''settings'' for all of these ''sites''
***PasswordMaker will generate the same ''password'' for all of these ''sites''
**you can optionally save the ''master password hash'', which is a very convenient and safe way to verify that you have entered the same ''master password'' when logging into as site as when you created the password - essentially preventing any ''failed logins''
- The main advantage of using the 'Advanced' options is the ability to customize the way PasswordMaker behaves for different sites/accounts

===Password Generation - Parameters and Triggers===

Regardless of which mode you are using, PasswordMaker makes it very easy to generate unique passwords for different sites on demand - and can optionally ''automatically'' detect when you are on a login page - or via a simple keystroke or toolbar button click - prompt you for the ''master password'', and then populate both the username and password fields.

*The parameters used to generate any given password are:
**the contents of the ''Using Text'' field, which by default is the ''URL components'' you have enabled (the default is to only use the [http://en.wikipedia.org/wiki/Top-level_domain TLD (top-level domain)] - e.g., ''passwordmaker.org''
**the username, if defined
**the ''extended attributes'' as provided, or modified by you
**the ''master password'' used

*There are two ways PasswordMaker can be ''triggered'' into action:
**manually, using the ''ctrl-`'' key combination, or
**automatically, if the ''Auto-populate'' option is enabled
***if ''Auto-populate'' is '''enabled''' for the ''Defaults account'', it can be selectively '''disabled''' for individual custom ''accounts'', or
***if ''Auto-populate'' is '''disabled''' for the ''Defaults account'', it can be selectively '''enabled''' for individual custom ''accounts''
**if there is no password field detected on the current web page, PasswordMaker will do nothing

When PasswordMaker is ''triggered'', it compares the currently detected ''URL pattern'' - which consists of only the components enabled in the ''Defaults settings'' - against the defined ''URL patterns'' for all of your custom ''accounts'', and
*if a match is '''not''' found in any custom ''accounts'' that you have defined, then the ''Defaults settings'' will be used
*if only one ''account'' contains a pattern match, the ''Master Password Prompt'' window is opened
*if more than one ''account'' contains a pattern match, the ''Account Selection'' window opens first, allowing you to select which ''Account'' you want to use, and '''then''' the ''Master Password Prompt'' window is opened

==Installation and Initial Configuration==

For Firefox, SeaMonkey, Mozilla Suite and Netscape, the installation is done automatically from [https://addons.mozilla.org/en-US/firefox/addon/469 addons.mozilla.org].<br>
Beta Releases can be downloaded from [http://passwordmaker.org/beta.html here]<br>
Older Releasescan be downloaded from [http://passwordmaker.org/installation2.html here]

When the installation is complete, a restart of your browser is required to make PasswordMaker available for use. Once you have successfully installed PasswordMaker, there are three ways to open it:

* the PasswordMaker option from the Tools sub-menu:
[[Image:tools-open.png]]
* the Toolbar icon (golden ring):
[[Image:Toolbar-1.7.gif]]
* the '''<ctrl> `''' shortcut key (almost always above the 'Tab' key) which looks like this on en-US keyboards: [[Image:Tildakey.gif|` - key]]

For Mozilla and Netscape users, the toolbar icon is installed by default. For Firefox users, the toolbar icon must be manually added by using the "View -> Toolbars -> Customize" menu, and then dragging the golden ring icon on to the toolbar.

TODO: need Flock installation instructions...

Once you've installed the extension and configured the Toolbar to your liking, you can ''Open'' PasswordMaker by either clicking on the main toolbar button (the golden ring are presented with the Basic Options screen:

==Basic Mode / Options==

[[Image:basic_options-pointers.png]]

Here we describe the textboxes and buttons on the Basic Options dialog.

===1. Master Password===

Your ONE "password to rule them all". This password, when combined with a URL (or whatever text string you choose), hash algorithm, optional l33t-speak, username, and counter, is used to generate unique, site-specific passwords, as explained in the introduction.

Note: the reference to 'One' ''master password'' is more symbolic than anything, as there is nothing to prevent you from using 2, 5, or as many different ''master passwords'' as you like - although that kind of defeats the purpose of PasswordMaker, which is to make things simpler, right?

===2. Store Master Password===

Once you have entered a ''master password'', you can click in this box and be presented with three options:
[[Image:basic-store-mpw-options.png]]
*'''Not at all''' - the master password is not stored anywhere at any time (memory or disk). This is the most secure option, but also the least convenient because you are prompted to enter the master password everytime a password is generated.
*'''In memory''' - the master password is stored encrypted in the browser's memory but not on disk. This option provides a reasonable trade-off between security and convenience. You won't be prompted to enter the master password again until all browser instances have closed (disposing memory contents), and the browser is re-opened. The master password is encrypted in memory so that if it's written to disk by the operating system as part of a swap file/paging file, it can't easily be decrypted.
*'''Store master password on disk and in memory''' - the master password is stored encrypted on the local hard drive and in memory. This option is the least secure, but the most convenient. You won't ever be prompted to enter the master password when using this option. Note: although the encryption used to store the master password is strong, the encryption/decryption key is also stored on your local hard drive. This makes decryption of the master password relatively simple. You should not use this option unless either (a) you are the only person with access to the hard drive, or (b) you are comfortable with the master password possibly being decrypted by others.

To erase the master password and encryption key from disk and memory, select the '''Not at all''' option, or simply clear the master password field from either the Tools sub-menu or the context menu:<br>
[[Image:context-clear-mpw.png]]

===3. Using Text===

By default, this shows only the ''URL compnents'' of the current URL being used to generate the password, but you can change this to anything you want.

[[Image:basic-using-text.png]]

===4. Generated Password===

Here you see the generated password. It'll be shown as plain test, or encrypted depending on your setting.

[[Image:basic-generated-password.png]]

===5. Copy Generated Password to Clipboard===

This button copies the generated password to the clipboard where it remains for the amount of time specified amount in the [advanced-options.xhtml Advanced Options] dialog (10 seconds by default).

===6. Advanced Options===

Clicking here will switch to the ''Advanced'' mode/options.

[[Image:basic-adv-opt.png]]

===7. Close===

The ''Close'' button closes the current dialog.

==Using PasswordMaker In 'Basic' Mode==

There are three ways that you will use PasswordMaker from this point forward (assuming you stick with it - and please do - it is well worth the effort - once you 'get it', you'll never know how you lived without it):
* [[Firefox/Mozilla/SeaMonkey/Flock/Netscape#Generate_Password_for_a_New_Account|to generate a password for a new account when you are first signing up]]
* [[Firefox/Mozilla/SeaMonkey/Flock/Netscape#Password_Change_Procedure|to change the password for an existing account]]
* [[Firefox/Mozilla/SeaMonkey/Flock/Netscape#Log-In_to_an_Existing_Account|to log into an account that you have already changed to a PasswordMaker password]]

Without PasswordMaker, when you go to any site that requires a username and password, you would manually type in your username, then your password, then click the 'Login' button (or sometimes you can just hit the ''Enter'' key).

You will still have to do this for each site that you use, in order to ''convert'' the site to work properly with PasswordMaker - but only one more time. From that time forward, you will be able to use PasswordMaker to populate those fields for you, quickly and securely, only having to remember your ''master password''.

As was suggested earlier, please choose some non-essential sites to do first, and make sure that you have properly set up an alternate email address, so that you can unlock the account if you inadvertently lock yourself out of it.

So, to get started, either:
* click here and print out the page the opens, so that you have these full instructions for changing your password handy, or
* open the site you will be using in a new [http://en.wikipedia.org/wiki/Browser_tab browser tab], and flip between the two sites that way
* follow the instructions for ''changing your password'' to one that PasswordMaker generates

===Generate Password for a New Account===

===Password Change Procedure===

When you go to a site which requires a password, PasswordMaker, depending on the settings, will either auto populate the password field, let you right click on the password field and give you the selection PasswordMaker in the context menu (todo: link to context-menu section). Then, depending on whether PasswordMaker knows your master password, or not, it will prompt you for your master password and populate the password box on the site, or just populate the password box on the site.

Again, depending on your settings, the password populated in to the password field of the site will either be an account specific, or a default password.

After PasswordMaker has been installed, you should decide whether you wish to log in to your online account, be it a bank account, a subscription type service, with an account / URL specific password, or a default password. The account specific password will be set up with a URL, so that PasswordMaker knows to use those specific settings for the site with the URL set up.

Of course, PasswordMaker can not and will not know your site specific password, unless you change the password of the site or service to the password generated by PasswordMaker. You do this by logging in to the site in question and select to change the password on that site. Typically, you will supply your old password and then a new password, which you will the have to enter again to confirm the new password. Here's an animated example of this process:

<swf width="663" height="358">ChangePasswordDemo.swf</swf>

===Log-In to an Existing Account===

When you visit a site which requires a password, just enter your username and right click on the password box and select PasswordMaker to fill in your password, which is determined by your settings. (todo: discuss CoolKey or link to CoolKey section). Then, when you click on the login button, you will be logged into the site. Here is another animated example:

[[Image:Login.gif|login animation]]

====Help====

This button displays the help page.

[[Image:button.jpg|File Menu]]

Firefox/Mozilla/SeaMonkey/Flock/Netscape/GettingStarted

2007-10-02T22:46:31Z

Tanstaafl: /* Password Change Procedure */

<table><tr align="left"><td valign="top" width="345">
__TOC__</td>
<td valign="top">
This edition of PasswordMaker is a small, lightweight, free (licensed under the [http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html LGPL] Open Source license), extension for many of the most popular [http://en.wikipedia.org/wiki/Gecko_(layout_engine) Gecko] based web browsers, including: [http://www.mozilla.com/en-US/firefox/ Firefox], [http://www.mozilla.org/projects/seamonkey/ SeaMonkey], [http://www.mozilla.org/products/mozilla1.x/ Mozilla Suite], [http://www.flock.com/ Flock] and [http://browser.netscape.com/ Netscape].

It creates unique, secure passwords that are very easy for you to retrieve, but no one else. Nothing is stored anywhere, anytime, so there's nothing to be hacked, lost, or stolen.

Much of the following information is applicable '''only''' to the 1.7.x versions of PasswordMaker. If you are using an older version, please [https://addons.mozilla.org/en-US/firefox/addon/469 upgrade], and then come back here to learn how to take advantage of all of the unique and powerful features PWM has to offer.

'''This page is in major flux, and will be changing rapidly over the next few days. Please do not attempt to edit this page until this notice is removed - which will be when all of the content has been updated, merged and migrated from the [http://passwordmaker.org website].'''
</td></tr></table>

==First Things First==

In order to prevent some of the most common errors - and to save you a lot of confusion and frustration - you are strongly encouraged to read this entire page, along with the [[Faq|FAQ]], at least once prior to attempting to use PasswordMaker.

===Precautions and Caveats===

PasswordMaker has two different 'modes' that it can operate in - ''Basic'', and ''Advanced''.

Using PasswordMaker in ''Basic'' mode (using only the ''Basic Options'') is very secure, and is the recommended way to start out, but there are certain things you should understand in order to avoid problems - the most common of which is locking yourself out of one of your online accounts.

With this in mind, it is best to:
*be sure that you have defined an alternate email address for any important accounts, so you will be able to 'reset' or 'recover' your password in the event that you lock yourself out (this is a good thing to do anyway, whether you use PasswordMaker or not)
*practice a few times on a throw away account, like gmail or yahoo - but the first recommendation still applies
*start out using PasswordMaker in ''Basic'' mode - but first learn the difference between ''Basic'' and ''Advanced'' modes so that you will know if/when you need to switch to the ''Advanced'' mode

'''Note:''' PasswordMaker is currently unable to populate ''Basic HTTP Auth'' pop-up prompts like this:<br>
[[Image:Basic_http_auth.png]]

===''Basic'' and ''Advanced'' Modes - Differences===

The main difference between the two modes is primarily one of complexity, in the form of the large number of configuration options. We will get into each in detail below, but for now:

*PasswordMaker uses the concept of ''Accounts'' to identify a group of ''settings'' that work together to generate a password

*'''In ''Basic'' mode''', there is only one ''account'' that matters (referred to as the ''Defaults account'') - so, only one group of ''settings'' (referred to as the ''Defaults settings''), that are applied to every site that you log into
- The main advantage of using only the ''Basic'' options is simplicity

*<b>In ''Advanced'' mode</b>
**you can create as many unique ''accounts'' as desired, each of which has its own ''settings'' that are applied only when that account is used
**you must define the URL(s) that identify each account
**you can define <b>multiple</b> URLs for any given ''account'', which means:
***PasswordMaker will use the same ''settings'' for all of these ''sites''
***PasswordMaker will generate the same ''password'' for all of these ''sites''
**you can optionally save the ''master password hash'', which is a very convenient and safe way to verify that you have entered the same ''master password'' when logging into as site as when you created the password - essentially preventing any ''failed logins''
- The main advantage of using the 'Advanced' options is the ability to customize the way PasswordMaker behaves for different sites/accounts

===Password Generation - Parameters and Triggers===

Regardless of which mode you are using, PasswordMaker makes it very easy to generate unique passwords for different sites on demand - and can optionally ''automatically'' detect when you are on a login page - or via a simple keystroke or toolbar button click - prompt you for the ''master password'', and then populate both the username and password fields.

*The parameters used to generate any given password are:
**the contents of the ''Using Text'' field, which by default is the ''URL components'' you have enabled (the default is to only use the [http://en.wikipedia.org/wiki/Top-level_domain TLD (top-level domain)] - e.g., ''passwordmaker.org''
**the username, if defined
**the ''extended attributes'' as provided, or modified by you
**the ''master password'' used

*There are two ways PasswordMaker can be ''triggered'' into action:
**manually, using the ''ctrl-`'' key combination, or
**automatically, if the ''Auto-populate'' option is enabled
***if ''Auto-populate'' is '''enabled''' for the ''Defaults account'', it can be selectively '''disabled''' for individual custom ''accounts'', or
***if ''Auto-populate'' is '''disabled''' for the ''Defaults account'', it can be selectively '''enabled''' for individual custom ''accounts''
**if there is no password field detected on the current web page, PasswordMaker will do nothing

When PasswordMaker is ''triggered'', it compares the currently detected ''URL pattern'' - which consists of only the components enabled in the ''Defaults settings'' - against the defined ''URL patterns'' for all of your custom ''accounts'', and
*if a match is '''not''' found in any custom ''accounts'' that you have defined, then the ''Defaults settings'' will be used
*if only one ''account'' contains a pattern match, the ''Master Password Prompt'' window is opened
*if more than one ''account'' contains a pattern match, the ''Account Selection'' window opens first, allowing you to select which ''Account'' you want to use, and '''then''' the ''Master Password Prompt'' window is opened

==Installation and Initial Configuration==

For Firefox, SeaMonkey, Mozilla Suite and Netscape, the installation is done automatically from [https://addons.mozilla.org/en-US/firefox/addon/469 addons.mozilla.org].<br>
Beta Releases can be downloaded from [http://passwordmaker.org/beta.html here]<br>
Older Releasescan be downloaded from [http://passwordmaker.org/installation2.html here]

When the installation is complete, a restart of your browser is required to make PasswordMaker available for use. Once you have successfully installed PasswordMaker, there are three ways to open it:

* the PasswordMaker option from the Tools sub-menu:
[[Image:tools-open.png]]
* the Toolbar icon (golden ring):
[[Image:Toolbar-1.7.gif]]
* the '''<ctrl> `''' shortcut key (almost always above the 'Tab' key) which looks like this on en-US keyboards: [[Image:Tildakey.gif|` - key]]

For Mozilla and Netscape users, the toolbar icon is installed by default. For Firefox users, the toolbar icon must be manually added by using the "View -> Toolbars -> Customize" menu, and then dragging the golden ring icon on to the toolbar.

TODO: need Flock installation instructions...

Once you've installed the extension and configured the Toolbar to your liking, you can ''Open'' PasswordMaker by either clicking on the main toolbar button (the golden ring are presented with the Basic Options screen:

==Basic Mode / Options==

[[Image:basic_options-pointers.png]]

Here we describe the textboxes and buttons on the Basic Options dialog.

===1. Master Password===

Your ONE "password to rule them all". This password, when combined with a URL (or whatever text string you choose), hash algorithm, optional l33t-speak, username, and counter, is used to generate unique, site-specific passwords, as explained in the introduction.

Note: the reference to 'One' ''master password'' is more symbolic than anything, as there is nothing to prevent you from using 2, 5, or as many different ''master passwords'' as you like - although that kind of defeats the purpose of PasswordMaker, which is to make things simpler, right?

===2. Store Master Password===

Once you have entered a ''master password'', you can click in this box and be presented with three options:
[[Image:basic-store-mpw-options.png]]
*'''Not at all''' - the master password is not stored anywhere at any time (memory or disk). This is the most secure option, but also the least convenient because you are prompted to enter the master password everytime a password is generated.
*'''In memory''' - the master password is stored encrypted in the browser's memory but not on disk. This option provides a reasonable trade-off between security and convenience. You won't be prompted to enter the master password again until all browser instances have closed (disposing memory contents), and the browser is re-opened. The master password is encrypted in memory so that if it's written to disk by the operating system as part of a swap file/paging file, it can't easily be decrypted.
*'''Store master password on disk and in memory''' - the master password is stored encrypted on the local hard drive and in memory. This option is the least secure, but the most convenient. You won't ever be prompted to enter the master password when using this option. Note: although the encryption used to store the master password is strong, the encryption/decryption key is also stored on your local hard drive. This makes decryption of the master password relatively simple. You should not use this option unless either (a) you are the only person with access to the hard drive, or (b) you are comfortable with the master password possibly being decrypted by others.

To erase the master password and encryption key from disk and memory, select the '''Not at all''' option, or simply clear the master password field from either the Tools sub-menu or the context menu:<br>
[[Image:context-clear-mpw.png]]

===3. Using Text===

By default, this shows only the ''URL compnents'' of the current URL being used to generate the password, but you can change this to anything you want.

[[Image:basic-using-text.png]]

===4. Generated Password===

Here you see the generated password. It'll be shown as plain test, or encrypted depending on your setting.

[[Image:basic-generated-password.png]]

===5. Copy Generated Password to Clipboard===

This button copies the generated password to the clipboard where it remains for the amount of time specified amount in the [advanced-options.xhtml Advanced Options] dialog (10 seconds by default).

===6. Advanced Options===

Clicking here will switch to the ''Advanced'' mode/options.

[[Image:basic-adv-opt.png]]

===7. Close===

The ''Close'' button closes the current dialog.

==Using PasswordMaker In 'Basic' Mode==

There are three ways that you will use PasswordMaker from this point forward (assuming you stick with it - and please do - it is well worth the effort - once you 'get it', you'll never know how you lived without it):
* [[Firefox/Mozilla/SeaMonkey/Flock/Netscape#Generate_Password_for_a_New_Account|to generate a password for a new account when you are first signing up]]
* [[Firefox/Mozilla/SeaMonkey/Flock/Netscape#Password_Change_Procedure|to change the password for an existing account]]
* [[Firefox/Mozilla/SeaMonkey/Flock/Netscape#Log-In_to_an_Existing_Account|to log into an account that you have already changed to a PasswordMaker password]]

Without PasswordMaker, when you go to any site that requires a username and password, you would manually type in your username, then your password, then click the 'Login' button (or sometimes you can just hit the ''Enter'' key).

You will still have to do this for each site that you use, in order to ''convert'' the site to work properly with PasswordMaker - but only one more time. From that time forward, you will be able to use PasswordMaker to populate those fields for you, quickly and securely, only having to remember your ''master password''.

As was suggested earlier, please choose some non-essential sites to do first, and make sure that you have properly set up an alternate email address, so that you can unlock the account if you inadvertently lock yourself out of it.

So, to get started, either:
* click here and print out the page the opens, so that you have these full instructions for changing your password handy, or
* open the site you will be using in a new [http://en.wikipedia.org/wiki/Browser_tab browser tab], and flip between the two sites that way
* follow the instructions for ''changing your password'' to one that PasswordMaker generates

===Generate Password for a New Account===

===Password Change Procedure===

When you go to a site which requires a password, PasswordMaker, depending on the settings, will either auto populate the password field, let you right click on the password field and give you the selection PasswordMaker in the context menu (todo: link to context-menu section). Then, depending on whether PasswordMaker knows your master password, or not, it will prompt you for your master password and populate the password box on the site, or just populate the password box on the site.

Again, depending on your settings, the password populated in to the password field of the site will either be an account specific, or a default password.

After PasswordMaker has been installed, you should decide whether you wish to log in to your online account, be it a bank account, a subscription type service, with an account / URL specific password, or a default password. The account specific password will be set up with a URL, so that PasswordMaker knows to use those specific settings for the site with the URL set up.

Of course, PasswordMaker can not and will not know your site specific password, unless you change the password of the site or service to the password generated by PasswordMaker. You do this by logging in to the site in question and select to change the password on that site. Typically, you will supply your old password and then a new password, which you will the have to enter again to confirm the new password. Here's an animated example of this process:

<flash>file=ChangePasswordDemo.swf|width=663|height=358|quality=best</flash>

===Log-In to an Existing Account===

When you visit a site which requires a password, just enter your username and right click on the password box and select PasswordMaker to fill in your password, which is determined by your settings. (todo: discuss CoolKey or link to CoolKey section). Then, when you click on the login button, you will be logged into the site. Here is another animated example:

[[Image:Login.gif|login animation]]

====Help====

This button displays the help page.

[[Image:button.jpg|File Menu]]