search

passwordmaker / chrome-passwordmaker

A browser extension based on passwordmaker.org. Create unique passwords for every webpage using a cryptographic hash algorithm.
https://passwordmaker.org
GNU Lesser General Public License v3.0
93 stars 53 forks source link

All my profiles vanished #198

Open LazarusMarhenke opened 11 months ago

LazarusMarhenke commented 11 months ago

I tried to get a password today in Chrome on my laptop and found that all of my profiles had vanished. There is literally nothing there but Default and Alphanumeric. The same is true in my mobile app on my phone. Unfortunately, the last time I exported my settings was in 2018, and there have been a lot of changes since then.

Strangely, the extension does recognize my master password (saved hash), so some part of my settings seems to have survived. I grepped around for one of my custom profile names and a custom character set that I could (partially) remember and found that this file had hits for both:

~/.config/google-chrome/Default/Local Extension Settings/fckpmekmkjglpmdcbfkchimdelcjiipd/000003.log

But it seems to be a binary file so I can't make much sense of it. Somehow my settings are in there, at least in part, but I don't know how to get them out and/or loaded into the extension.

I am using https://chromewebstore.google.com/detail/passwordmaker-org/fckpmekmkjglpmdcbfkchimdelcjiipd version 0.9.8 in Chrome 116.0.5845.179 on Linux.

On my phone I am using https://play.google.com/store/apps/details?id=org.passwordmaker.android&hl=en on Android 12.

heavensrevenge commented 11 months ago

Were you using the synchronization feature?? It must have been from the migration away from localStorage since migration is being forced. So if you press "F12" on the options page, and look at the localStorage section, are there entries there? Hopefully your encrypted settings are still there. I haven't had the opportunity to migrate the sync settings yet so ATM the extension just doesn't see them.

  1. see if the the entires are in localStorage
  2. decrypt
  3. save the profiles & import them

As long as they are in localStorage this should be fine. And DON'T clear your browser's cache!

If the entries are in localStorage, In the console on the same options page, run this command: Settings.decrypt(localStorage.getItem("sync_profiles_password"), localStorage.getItem("synced_profiles"))

And copy that resulting profile string so you can save a local copy and import them back into the extension.

LazarusMarhenke commented 11 months ago

I don't see any profiles in Local Storage. Here's what I find there for chrome-extension://fckpmekmkjglpmdcbfkchimdelcjiipd (listing "Key: Value"):

store_location: never sync_profiles: false synced_profiles: synced_profiles_keys:

Both of the last two are blank. When I click on them, the panel below says "Select a value to preview".

Also, we just discovered that the same thing has happened to my wife's system, Chrome 120.0.6099.71 on MacOS Ventura 13.6.2.

LazarusMarhenke commented 11 months ago

The Local Storage on my wife's machine is almost the same. She has "store_location: memory_expire" but all the others are the same, including the two that are blank.

heavensrevenge commented 11 months ago

What happens if you try running chrome.storage.sync.get().then((result) => { console.log(result) }) In that console on the options page? I really hope there are entries there we can concatenate and decrypt...

LazarusMarhenke commented 11 months ago

I got:

Promise {<pending>}
 {}
  [[Prototype]]: Object

I didn't see any change in the options page (no profiles appeared, at least).

heavensrevenge commented 11 months ago

Some result should have appeared in the console as a result on the command line if there was any data which had been synced. The outlook doesn't look good though... those are the only other places your profile data would have been hiding in order to recover it... Do you by chance have home directory snapshots enabled? May be a last bastion or hail mary to recover the data. As of this moment, I'm unsure how to recover your lost profile data.

LazarusMarhenke commented 11 months ago

Sadly, I don't have home directory snapshots. I can probably reconstruct my profiles manually from the data that I can see in that 000003.log file that I mentioned, but do you have any idea what happened? It makes me nervous, especially because it happened to two of our systems (my wife's and mine, on different Chrome versions and different OSes) seemingly at the same time.

heavensrevenge commented 11 months ago

How long has it been since you used your configured profiles? If anything they should have disappeared ~1 week ago with the previous update I pushed out.

  1. grab the data from that file; which will be: synced_profilesø>"[{\"rdf_about\": {bunch of profile text} }]" or profilesù>"[{\"rdf_about\": {bunch of profile text} }]" whichever you choose and whichever looks best to you
  2. sanitize it with https://www.site24x7.com/tools/json-beautifier.html
  3. on the command line: Settings.profiles = JSON.parse(sanitizedJson) (inside the JavaScript command line on the extension options page)
  4. upon successful command completion, run Settings.saveProfiles()
  5. Go to export section in options and grab the exported rdf (they will not show up in profile list automatically)
  6. ?
  7. PROFIT!?
LazarusMarhenke commented 11 months ago

I don't remember exactly when the last time I used one of these profiles was, but it is quite possible that I hadn't used any of them in the last week, so that's not too mysterious. My worry is: How do I prevent this from happening again? If it were only on my system I could believe I'd made some weird mistake, but with the exact same thing happening to my wife on her very standard Mac+Chrome installation with no unusual stuff going on, it seems like this could be a real problem.

I have some questions about your suggestion for recovering my data from the file that I do have: What exactly do I copy and paste into the json-beautifier? Do I want the profilesù> part? That seems to have some kind of binary data within it, judging from the accented character (my hex editor shows the two bytes in between profiles and "[{\"rdf_about as being 0xF4 0x39). Or do I start just after that at the quotation mark? Or do I start where the array starts (with the [)?

More details, in case they're useful for diagnosing the problem: In that file, my synced_profiles seems to be empty: There is no "[{ after it, and it seems instead to have an empty "". The precise sequence is synced_profiles, followed by 0x02, followed by "". Only profiles has sensible data right after it. (Obviously, then, I would use the profiles data to attempt a recovery.)

LazarusMarhenke commented 11 months ago

Also, what could cause it to lose all my profiles but still remember my saved master password hash? It seems a little weird that it remembered something.

heavensrevenge commented 11 months ago

It is very weird, I haven't had any other reports for over a week. With something so major I would expect a quick report.

The data you want is in-between the quotes called a string. You want everything from "[{ to its matching }]" including the start and end quotes that is a string which you can either email me to sanitize or you can try to sanitize it yourself and upon it being valid using the JSON web tool, pass the whole validated string from the site into the Settings.profiles = JSON.parse("[{ sanitizedStringDataYouGetFromWebsite }]") function and upon successful completion, immediately call the Settings.saveProfiles() function which should allow you to export your profile data from the options page UI for safety.

LazarusMarhenke commented 11 months ago

I would also expect a quick report for such a severe issue. :) Like I said, if it were just me I could believe it's a one-off, but with the same thing happening to my wife (on a different Chrome version and different OS) I'm not so sure.

I believe I managed to recover my data using the method you described. I had to do some surgery; somehow there was some binary data in the passwordPrefix field of one profile and the sanitizer didn't like that, but I think the rest survived. If that one profile no longer works it's a worthy sacrifice. Thank you for your help!

heavensrevenge commented 11 months ago

Glad you have succeeded in recovering most of your data! I'm still stumped as to what may have caused it though...

heavensrevenge commented 10 months ago

@LazarusMarhenke so far no one has had the same issue. I am curious as to how only you had this issue. But if no one else has a similar problem I'll close this issue within ~a month.

LazarusMarhenke commented 10 months ago

Yes, it's baffling. I wish I could figure out something unusual but shared in my wife's and my setup, but I can't. :) Thanks for all your help in recovering my data!

gpbenton commented 10 months ago

My profiles have disappeared from all my browsers this morning. Also when I press any of the menu items in the options page, nothing happens, so I cannot import anything from a backup (which I fortunately have from a few days ago).

It looks like I have version 0.10.0, so I suspect that is the problem. My configuration had been stable for several years before this morning.

heavensrevenge commented 10 months ago

If you press the F12 key on the options page or right click and inspect, do you see an error in the console tab that you can copy and paste here to me?

gpbenton commented 10 months ago

I have uninstalled the extension and re-installed it, which seems to work until I enable 'Sync Profiles Between Computers'.

When I enable that option, the computer with the profiles, that should send data to the other machine, hits the state described above.

Unfortunately, I have had extensions synced between my machines, so PasswordMaker got a new version on every machine when I started it, and that reset the state.

I'll enable sync again, to see if I can get back to the failed state.

heavensrevenge commented 10 months ago

Hmm, I'm very curious what the error message says in the developer tools console @gpbenton if you are able to find it and if there is one.

gpbenton commented 10 months ago 
Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'length')
    at options.js:265:47

This was on the computer that was receiving an update (a new profile I created on the other instance).

heavensrevenge commented 10 months ago

Are there any more errors below it? Mentioning a few more files and numbers?

gpbenton commented 10 months ago

image No, that is all that is in the console

heavensrevenge commented 10 months ago

@gpbenton in that console, Paste in: chrome.storage.local.clear()+ Press enter to run and then chrome.storage.sync.clear()+ Press enter to run then reload (control+r), the page should load and you should then be able to import your profiles, I'll need to work on this to fix it right but that should hold you over for now.

+1 for KDE

gpbenton commented 10 months ago

Thanks, I have 10.1 running on 3 machines now, and they all seem stable. But I have created a new test profile on one of them, and I have not seen it sync to another machine yet. Has this broken the sync mechanism?

heavensrevenge commented 10 months ago

As long as you are logged into the browser on each machine and have extension sync turned on, it should sync the newest data, refreshing the options page should show the latest sync data, but not sure how quickly brave syncs their data, on Chrome it's only a few seconds.

heavensrevenge commented 10 months ago

Actually @gpbenton 10.1 doesn't have the fix, when 1.0.0 comes out it will have the fix but 0.10.1 doesn't. Sync is a tricky beast for some reason. But if all the sync browsers are enabled and in this extensions options sync there is green, everything should sync.

gpbenton commented 10 months ago

I finally got 1.0.0 installed, and everything works fine, including the sync of profiles between computers.

Thanks for your help. Syncing is tricky in everywhere :-)