Victoria's Blog

Retrieving Stored Chrome Password Without Knowing Microsoft Account Password

TL;DR;

Let Chrome fill in the website credentials, then edit the HTML to change the password box removing the type password.

Background Story

This year, I’d planned before christmas to take 2 weeks off in June to go to Cornwall but as with everyone else in the UK, my holiday plans were changed by the recent lockdown.

My neighbour across the road asked for some help with her email account on the first day of my holiday (yes, busman’s holiday 😂) which turned out to be a bit of a saga… I thought it’d be as simple as a password reset.

First thing, the router only showed a power light… odd… take the power cable out the back, plug it in, red lights all the way down the panel – not good… maybe it’ll clear after 3 minutes or so… No such luck… The router had packed up 🤣! I tried pluging it into a different socket, taking the power lead out again, clicking the reset button – nothing… So I’d gone across the road to fix the email issue and now the routers dead – couldn’t make it up!

So I did the right thing and called BT – not a company I’ve delt with before and I’d herd not great things but I was pleasently suprised that I got through to someone in the UK who identified the router was dead and tried to order my neighbour a new one. The lady from BT couldn’t get the order processed so said she would pass on the request to her manager via email and a new one would be in the post by the end of the day. I asked how we’d know it was ordered only to be told, my neighbour would receive an email 🤣, I then pointed out that was the reason I’d popped round today – to fix the email issue. Kindly she offered to call me on Thursday to setup the new router and sort out the issue with the email account and we left it at that.

An hour later, I had a call from the lady at BT saying a new router was in the post and it’d be there by tomorrow!! Brilliant stuff (and great customer service)!

Next day, the router arrived in the post, plugged it in, nothing happened – thought YOU HAVE GOT TO BE KIDDING ME!! Took the power cable out the back, re-plugged it in, still nothing. Scrambled under the desk and took the plug out of the socket and put it in a different one… still nothing. Scrambled under the desk again and took the two part plug apart and put it back together again, heard a lovely click which I didn’t the first time putting the plug together, plugged it back in and this time the new router lit up 😀 Thank goodness!

Because I was expecting a call on Thursday to help sort out the email issue, I then went home to wait for Thursday’s call re. helping reset the email password. Sadly I didn’t get a call on Thursday so decided to call the BT helpline again – option 4 this time as it was email specific. As I was explaining to the guy on the line that we couldn’t do a password reset because we couldn’t answer the security questions, I was running through the email login page, clicked in the username field (for the first time) and Chrome prompted the credentials. A little bit embarrised, I told the guy, it’s ok, we’ve located the details but he did help confirm the security question answers.

After the call was over, I tried to retrieve the password from Chrome but it uses the Windows account credentials to protect the pasword vault and my neighbour didn’t know the password for Windows. So next option was to reset the password using the now confirmed security answers we had for the security questions. Unfortunately we hadn’t confirmed with the support guy that we had the spelling to the security answers so couldn’t reset the password!!

I said to the neighbour, it’s ok, we’ll get the password reset by phone if you buy a new device and left it at that.

Never one to leave an issue unsolved, I went home and started googling how to get the password out of Chrome. Someone had created a YouTube video showing some dodgy sofware that could be used to read the SQL database but that didn’t appeal… I then decided to setup an example in Chrome with a saved credential of my own – I don’t use Chrome as my default browser (yes shock horror!!) – and suddenly had a brainwave… wonder if you could get Chrome to fill in the credentials and then edit the HTML to change the text box from type password to plain text (while also thinking surely the developers would stop such an obvious flaw)?? It worked!!

This method of retrieving a password does work for other browsers (tested in Firefox) but Chrome was the relevant browser being used by my neighbour hence the post title 🙂