Sneezry / authenticator

This repository has moved to https://github.com/Authenticator-Extension/Authenticator
Apache License 2.0
174 stars 95 forks source link

Possible to decode an encrypted secret key? #281

Closed bmg177 closed 6 years ago

bmg177 commented 6 years ago

Im having a problem importing an encrypted secret key. Is is possible for anyone to decode it so I re-add it manually?

{Removed}

bmg177 commented 6 years ago

The security of this account doesn't matter, but I would like to get access to it again if possible

mymindstorm commented 6 years ago

You can't decrypt an account that has a password if you lost it. Does it just show dots after you import? Set the index to 0 (this only works if you don't have any other accounts in authenticator)

bmg177 commented 6 years ago

no luck setting the index to 0. Im seeing "Undefined - o o o o o o" same as before

Although, now when I go back to check, its showing 6-7 entries, all undefined. Im guessing the old data is being fetched from somewhere? Is there more I have to do to, besides uninstalling, to get rid of the old data?

bmg177 commented 6 years ago

FWIW, I never actively chose to encrypt the keys and I didn't have them password protected originally

mymindstorm commented 6 years ago

Go to the "Import / Export" menu. You should check the value of "index": and make sure that it increments by one (starting from 0). E.g.: {"secret1": {"index":0}, "secret2": {"index":0}, "secret3": {"index":2}} should be corrected to {"secret1": {"index":0}, "secret2": {"index":1}, "secret3": {"index":2}}. Then open and close edit mode to make sure it updates.

mymindstorm commented 6 years ago

Just fyi, you should never post the data in between the {} here. Also iirc the data you posted was set to have a password on it, if you can't find that password then you are out of luck.

bmg177 commented 6 years ago

When I click emport/import, it only shows the 1 entry I posted earlier (index 0) but the main window is showing 6 entries-- all Undefined - o o o o o o

mymindstorm commented 6 years ago

If import / export only showed that entry it should be fine? Did you click update after replacing all the text with the code?

For the time being, try resetting the extensions data (you should just need to reinstall it) and pasting your codes back in from a backup (make sure to save codes somewhere before uninstalling!). Make sure that after you install it again that no codes show when you open it for the first time, and then load from the backup.

bmg177 commented 6 years ago

ok I tried it again. Reinstalled and the main page was blank. Imported the single entry as index 0 and clicked update. The code appeared as Undefined again. Then when I clicked away and clicked on the extension button again there were 6 Undefined entries. I checked the import/export window after and there was still only the 1 entry I had just entered

bmg177 commented 6 years ago

I also don't remember using a passphrase. If I wanted to try a few passphrases after importing, how would I do that? I click security but it only allows me to add a new passphrase

mymindstorm commented 6 years ago

Messing with the passphrase now would probably just make it even more confused. Your data is malformed somehow, but it didn't seem that way at first glance when I removed it from your post.. This is only really a hunch (and I'm not going to be near a computer for a while so I can't really test this myself) but you didn't just paste the code in, right?

It should be:

{ "Hash": { secret  } }

I think you might have it like

{ secret }

Where secret is all the text inside the brackets that includes stuff like "index": 0

bmg177 commented 6 years ago

Okay I will mess around with it and see if i can figure it out. If you still have the info and want to play around with it when you get back, that would be appreciated. The security of that code is not very important, but I would like to get it working, if possible.

mymindstorm commented 6 years ago

If the security of the code was important, then you shouldn't have included it when you opened the issue and should definitely change it if you haven't taken note of that already. It's probably easiest at this point to start trying to recover the account, but I'll see if I can do anything to help.

On Feb 9, 2018 2:12 AM, "bmg177" notifications@github.com wrote:

Okay I will mess around with it and see if i can figure it out. If you still have the info and want to play around with it when you get back, that would be appreciated. The security of that code is not very important, but I would like to get it working, if possible.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/Sneezry/authenticator/issues/281#issuecomment-364364560, or mute the thread https://github.com/notifications/unsubscribe-auth/AagJ7rnQVLIytLKjamm_Onk8iaABC1-Xks5tS_37gaJpZM4R_WNe .

bmg177 commented 6 years ago

ahh i see now, adding hash to the equation did the trick. Thank you sir :)

mymindstorm commented 6 years ago

Just to be safe, I would manually copy the secret and re-add the code normally just to make sure that the hash is correct.