Reveal your saved Passwords in Firefox

Many users save their passwords in Firefox so that they do not have to enter it again when visiting the website it was saved for again. Firefox remembers the password and enters it automatically if the user selected this option on his first visit. This is great for us lazy users but poses the problem that we sometimes can’t remember the password when we need it again.

A classic example would be a Gmail user who has been using the Gmail website so far now trying to get the POP3 access running. So, what is this user going to do ? He actually has several options to reveal the password in Firefox. The first that comes to my mind is the ability to go into the security tab of the options. You do find a show passwords button there that displays all passwords, usernames and site urls.

I have written about this before and want to concentrate on other possibilities. Please note that a master password has to be entered for all the following methods if one has been set.

1. Greasemonkey Scripts:

If you are using the excellent Greasemonkey extension you can choose from a wide variety of scripts that reveal the passwords:

Show Password on Click - displays the password if you click the password form.

Show Password onMouseOver - reveals the password if you hover the mouse over the password field.

Unpassword - changes the type of the password form to text which always displays the passwords as text.

2. Javascript Code

Paste the following line of code into the address bar and hit enter to reveal the password on this website.

javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j<F.length; ++j) { f = F[j]; for (i=0; i<f.length; ++i) { if (f[i].type.toLowerCase() == "password") s += f[i].value + "\n"; } } if (s) alert("Passwords in forms on this page:\n\n" + s); else alert("There are no passwords in forms on this page.");})();

3. Firefox extension

Unhide Passwords - this extension does basically the same as the Unpassword Greasemonkey script.

[via gHacks]

Man hijacks 90 eBay accounts

An Australian man pleaded guilty to breaking into eBay and a local bank to steal AU$42,000 (about $34,000), in a case that demonstrates the problem of account takeovers on the auction site.

Dov Tenenboim, 21, of the Sydney suburb of North Bondi, stood accused of breaking into at least 90 different eBay seller accounts last year, mostly by guessing passwords. Tenenboim frequently figured out the credentials by matching usernames to passwords, prosecutors said. Other times he hacked into email accounts.
Following a familiar route, Tenenboim targeted users with highly favorable feedback ratings from their eBay peers. Posting under the guise of a trusted user with an established account makes it easier to dupe buyers.

After hacking the accounts, Tenenboim used them to advertise non-existent iPods, according to the Sydney Morning Herald. He also hacked into the Commonwealth Bank. He pleaded guilty to two counts of making a false statement to obtain money, two counts of obtaining money by deception and four counts of committing an unauthorized computer function. Tenenboim faces a maximum of 11 years in jail and fines of $9,900.
Account takeovers have been a persistent problem on eBay. Over the past several weeks, we've observed hundreds of fraudulent auctions being offered by users with unblemished records. Such hijackings are on the rise, according to a small but vocal group of eBay users, who also claim the breaches are the result of an unpatched security hole in the company's defenses.

eBay strongly denies such a hole and says the takeovers are the result of users having their log-in credentials snatched through lax passwords and phishing attacks. Tenenboim's methods appear consistent with such statements.
But eBay can't be let off the hook completely. The company employs lax password requirements that, for instance, allow a user ID of james34231 and a password of james34. (To be fair, Google Mail allowed the same combination, though the site warned it was only "fair.")

What's more, eBay, like the vast majority of online services, has no mechanism in place to allow account holders to log in using security keys that generate random numbers every minute or so. Such devices would render most current password attack methods ineffective.eBay has said it is in the early stages of testing such a system for its PayPal users, and a spokeswoman says the key will also work on eBay.

C by register