Editing FAQ

== General ==

=== What browsers/platforms are supported? ===

The extension works with Firefox, Mozilla, and Netscape on Windows, Mac, and Linux/Unix. An Internet Explorer extension is currently being developed. The on-line version works with all browsers (including Internet Explorer and Opera) on all platforms. The desktop version is written in QT/C++ and works on Windows, Mac, and Linux/Unix (Actually, any place that QT can be compiled on). The J2ME version (also coming soon) works on any Java-enabled mobile phone or PDA.

=== If someone gets my master password, can't he determine all of my generated passwords? ===

No. There are ten other variables he would need for each account. They are:
* URL
* character set
* which of nine hash algorithms was used
* date counter (if any)
* username (if any)
* password length
* password prefix (if any)
* password suffix (if any)
* which of nine l33t-speak levels was used
* when l33t-speak was applied (if at all)
Probably the most interesting of these is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

=== Can someone "unscramble" my generated passwords to determine my master password? ===

This is a common complaint heard about hashed-based password systems (for example, see page two of [http://passwordmaker.org/jhalderman.pdf A Convenient Method for Securely Managing Passwords]). The complaint simply doesn't hold water with PasswordMaker because PasswordMaker adds nine other variables not used in the traditional password=master+url formula. Those nine variables create an enormous search space which would take thousands of years to search, even using a distributed network of one million modern PCs. The nine variables are:
* character set
* which of nine hash algorithms was used
* date counter (if any)
* username (if any)
* password length
* password prefix (if any)
* password suffix (if any)
* which of nine l33t-speak levels was used
* when l33t-speak was applied (if at all)
Of course, the URLs of the sites must also be known since they are used in password calculation. Probably the most interesting of these variables is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

=== Where is my master password stored? ===

Nowhere, unless you choose the option Store Master Password on disk and in memory (encrypted). If you choose this option, your master password is stored using 256-bit strong encryption in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, [http://kb.mozillazine.org/Profile_folder look here]. For further protection you can instruct your operating system to encrypt passwordmaker.rdf. Instructions on how to do this with Windows XP/2000/NT are [http://support.microsoft.com/kb/307877/EN-US/ here]. Instructions for Mac OS/X Tiger are [http://www.apple.com/macosx/features/filevault/ here].

=== Where are the generated passwords stored? ===

Nowhere. The generated passwords are calculated on-the-fly as they are needed. The RAM used to store and calculate the generated passwords is proactively cleared to prevent passwords from being stored in a swap file/virtual memory/paging file.

=== How do I know PasswordMaker isn't sending my passwords to you without my knowledge? ===

Although you can read the source code to determine this for yourself, there's an easier way. Install a packet sniffer and use PasswordMaker to generate some passwords. You won't see any traffic to or from PasswordMaker -- ever. It never connects to the internet. Two popular packet sniffers are [http://www.snort.org/ snort] (for Unix/Linux/OSX) and [http://www.lazydogutilities.com/ipprev.htm ipInterceptor] (for Windows). Both tools reveal *all* network traffic, not just HTTP.

Another way would be if you have a two-way firewall installed. PasswordMaker will never trigger an outbound connection notification from your firewall (although it may trigger an inter-application process notification, depending on the firewall in use).

=== If I don't want to change all of my passwords, is PasswordMaker still a good choice? ===

Yes. PasswordMaker provides a secure method for encrypted storage of a specific, user-provided password for a custom Account. This way you can take advantage of PasswordMaker's other features (such as form completion) while still choosing your own passwords.

To set up a URL/site in this manner, simply go to the login page for the Account that you want to save the password for, create a new (or open the existing) Account for this URL/site, change to ''Advanced Options'' (if you are not already there), click the ''Advanced Auto-Populate'' tab, click '''<u>inside</u>''' the '''password''' field on the login page, click inside the ''Field Value'' field, enter your current password, then click the <i>Add></i> button (just above the list-box for fields), and last but not least, if desired, check ''Auto-populate username and password fields for sites that contain this URL''.

=== Which hash algorithms are supported? ===

* MD4
* HMAC-MD4
* MD5
* MD5 (for PasswordMaker v 0.6)
* HMAC-MD5
* HMAC-MD5 (for PasswordMaker v 0.6)
* SHA-1
* HMAC-SHA-1
* SHA-256
* HMAC-SHA-256
* HMAC-SHA-256 (for PasswordMaker v 1.5.1)
* RIPEMD-160
* HMAC-RIPEMD-160

=== Which hash algorithm should I use? ===

All of the algorithms are cryptographically strong, but of the algorithms PasswordMaker offers, many people regard SHA-256, HMAC-SHA1, HMAC-MD5 and HMAC-SHA-256 as the strongest.

=== What about recent press concerning MD5 AND SHA-1 "cracks"? ===

At Crypto 2004, Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu announced [http://eprint.iacr.org/2004/199.pdf they had found hash collisions] for MD4, MD5, RIPEMD, and HAVAL-128. SHA-1 hash collisions have also been announced. A [http://en.wikipedia.org/wiki/Hash_collision hash collision] means the researchers found two or more messages that yield the same hash with these algorithms. However, it's important to note that the one-way nature of these algorithms has not been undermined. In other words, in the context of PasswordMaker, [http://en.wikipedia.org/wiki/Hash_collision hash collisions] do not empower someone with the ability to derive your master password if they have your generated (hashed) passwords. The hash collision attacks have no relevance to PasswordMaker except there is very small chance someone could choose a different master password than yours which hashes to the same generated password. However, he would still need your username and the URL in order to hack your account.

=== Do you provide technical support? ===

Yes! Free technical support is provided on the [http://forums.passwordmaker.org/ Forums], with a response time typically less than 24 hours.

=== Where can I find an explanation of each and every feature and function? ===

Right here!

=== How is PasswordMaker licensed? ===

PasswordMaker is licensed under the [http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html LGPL] Open Source License. The desktop edition (because of QT) is licensed under the [http://www.gnu.org/licenses/old-licenses/gpl-2.0.html GPL] Open Source License.

The full sources for PasswordMaker can be downloaded from [http://sourceforge.net/projects/passwordmaker here].

=== What if I forget my Master Password? ===

You're out of luck.

== Firefox / Gecko edition ==

=== Is there an Internet Explorer version? ===

There was a Beta version of PasswordMaker for Internet Explorer 6 and 7, but it was never finished. It currently isn't maintained, and users are discouraged from installing it because it is highly unlikely that there will be any further development on it, unless a sponsor steps forward. If you are interested in sponsoring the Internet Explorer version, please feel free to post a message on the [http://forums.passwordmaker.org/ Forums] and someone will get in touch with you to see if an arrangement can be made.

=== Where is account information and other settings stored? ===

Everything is stored in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, look [http://kb.mozillazine.org/Profile_folder here].

=== How does PasswordMaker defeat keyloggers? ===

Keyloggers work by tracing every key typed on the keyboard. With PasswordMaker, you never type anything but your master password (and if you choose <i>Store Master Password on disk and in memory (encrypted)</i>, you only type that <b>once</b>). The <b>real</b> passwords (generated ones) are never typed, so keyloggers never detect them!

=== How does PasswordMaker defeat phishing attacks? ===

Most phishing attacks occur when you navigate to a URL which appears to be that of a site that you trust, but actually is owned by an attacker. For example, you might navigate to http://www.bc1.lu/ instead of the Bank of Luxembourg's legimite URL, http://www.bcl.lu/. The only difference between these two URLs is the lower-case letter <b>L</b> (used by the legitimite site) and the number <b>1</b> (used by the deceptive site). The attacker's intent is to get you to enter your username/password credentials on his deceptive site. He can then use those credentials on the legitimite site to do nefarious things.

If you use PasswordMaker, you'll be safe and secure. This is because the password it generates is based on the URL to which you've navigated. The password generated at a deceptive site is completely different than the one generated at a legitimite site (because their URLs differ, even if by one character). You might still be fooled into thinking http://www.bc1.lu/ is the Bank of Luxembourg, but the attacker will get the wrong password if you use PasswordMaker.

=== I want to use the same password for more than one site. Is this possible? ===

Yes! Let's suppose you want a Yahoo! account to use the same password as a gMail account. Go to the <i>Advanced Options</i> dialog and create a new account. Click on the <b>URLs</b> tab, and add a second pattern that will match the gMail login URL - in fact, you can add as many patterns as you want to match for this account, and they will all use the same password! The only caveat to this is, if they have different usernames, PasswordMaker won't be able to automatically populate the usernames for you, because you can only define one username per account - but if they all share the same username, PasswordMaker will populate everything automatically for you for all of them. That's it!

=== Can PasswordMaker accomodate sites that force me to change passwords periodically? ===

Yes! Go to the Advanced Options dialog and create a new account. In the <i>When URL Contains</i> field, type <b>mybank.com</b>. In the <i>Use the following text...</i> field, type <b>'mybank.com'</b>. In the <i>Modifier</i> field, type any text (such as a date or number) that you wish to change over time. For instance, you could type <b>September 2007</b>. When October comes and the bank expires your password, simply change the Counter to <b>October 2007</b>. You might instead choose to use an incrementing number. For example, <b>1</b> for this month, <b>2</b> for the next month, etc. Any text that you enter in the <i>Counter</i> field will vary the password.

=== Can I share my settings between multiple computers? ===

PasswordMaker has "Export Settings" and "Import Settings" options, as well as the ability to upload/download your RDF file to/from an FTP site.

Exporting the settings saves them to a file (with the option to include/exclude the master password in encrypted form), while importing settings takes a file and imports its contents as if you'd manually entered them. You can synchronize two or more PCs this way.

There are plans to optionally save this file on an FTP site so you don't need to transport it across PCs, but you can always opt-out of this. In the meantime, you can store exported settings centrally somewhere yourself (like your web-based email account) to make it easy to import them from anywhere.

=== How can I change PasswordMaker's shortcuts (ctrl-` and alt-`) to something else? ===

Install the [http://mozilla.dorando.at/keyconfig.xpi KeyConfig Extension]. Scroll down to the PasswordMaker entry and change the shortcuts to anything you like. Changes won't take effect until you restart Firefox/Mozilla.

=== How can I turn off the toolbar icons for Mozilla and Netscape? ===

You can turn it off (and back on again) by creating the new boolean preferences browser.toolbars.showbutton.passwordmaker and browser.toolbars.showbutton.passwordmaker-key in about:config or user.js with the value of true or false. Make sure to restart all browsers after making the change.

=== How do I uninstall PasswordMaker? ===

If you're using Firefox, it's quite simple. Select Tools -> Extensions, select PasswordMaker and click the Uninstall button.

If you're using Mozilla or Netscape, it's as simple as deleting two files and one directory:

* If you installed PasswordMaker to a profile, locate that profile's directory (read this if you don't know how to find it). If you installed PasswordMaker to the browser directory, locate your Mozilla or Netscape installation directory (read this if you don't know how to find it).If you don't know where you installed PasswordMaker, try to remember how you answered this prompt when installation began:
[[Image:mozilla-install.jpg]]

The rest of these directions refer to the path you've identified as path.

* Delete the file /path/chrome.rdf. This file is automatically regenerated the next time you start Mozilla or Netscape.
* Delete the file /path/chrome/passwdmaker.jar
* Delete the directory /path/chrome/overlayinfo. This directory is automatically recreated the next time you start Mozilla or Netscape. If you restart and this directory hasn't been recreated, don't worry: it just means you don't have any other extensions, themes, or skins installed.

== Desktop edition ==

== Javascript edition ==

== Yahoo! Widget edition ==

== Command-line edition ==

== PHP / Mobile edition ==

== On-line edition ==





== How do the account-settings and algorithm I choose work together to generate passwords? ==

If you've selected a non-HMAC hash function (those without the HMAC prefix), passwords are generated using the following pseudocode:

password = mp + usingURL + username + modifier<br>
password = leet(password, leetlevel)   [optional]<br>
password = hash(password, charset)<br>
password = leet(password, leetlevel)   [optional]<br>
password = truncate(prefix + password, length-suffix_length) + suffix<br>
password = truncate(password, length)

If you've selected an HMAC hash function (those with the HMAC prefix), passwords are generated using the following pseudocode:

data = usingURL + username + modifier<br>
mp = leet(mp, leetlevel)   [optional]<br>
data = leet(data, leetlevel)   [optional]<br>
password = hmac_hash(mp, data, charset)<br>
password = leet(password, leetlevel)   [optional]<br>
password = truncate(prefix + password, length-suffix_length) + suffix<br>
truncate(password, length)

Where + is the concatenation operator. mp is the master password, usingURL is the value in "Using URL", and username, counter, prefix, and suffix are optional settings specified in the Account Settings dialog. For HMAC hash functions, mp is the secret key and data is the input text.