Forgot master password, anyway to backup bitwarden app + appdata on non-rooted Android to a rooted Android device to get the data.json/password hash and help make brute-forcing easier?

Ask the Community Password Manager
,
1

Yup, another one of these, I apologise - I’m logged in to the android app on my non-rooted S22U via fingerprint and PIN, and via the Firefox addon with PIN and set the timeout to Never… before I would have to enter my master password quite frequently, which is why I turned it off … foolish move in retrospect…

I have read the following:
link 1 link 2 link 3
and have asked on this post already

which is the main reason for my question - is there any way to use the Google One backup of Bitwarden from my unrooted Android (S22 Ultra) and restore it to my older, rooted, LG. The adb backup on the S22U and the adb restore on the LG didn’t seem to work as I didn’t have Bitwarden installed or logged in on my LG. Trying to figure out how to restore from Google One backup and it looks like I will have to wipe the LG to start the restore from Google One… Has anyone tried this or have any insight into this?

Anyway, started already slowly but surely migrating all my passwords and accounts one by one and wishing I had updating my password hint so it wasn’t for my old password (that I changed probably a year ago now, or more) and wishing I had written my password down somewhere…

2

Regarding your new vault, you might read through this guide: Guide for Getting Started on the Right Foot in Bitwarden ™ (Version 2.0). It covers all the basics to ensure you don’t end up in this same position again.

And, please use the password hint only for a reminder where your emergency kit is stored.

1 Like
3

You say you are logged in on one mobile client and on a firefox extension.

Are you able to login with device on the web vault?

With the firefox extension you could try this: https://dan.pastusek.com/articles/how-to-export-a-vault-from-bitwarden-without-knowing-the-master-password (disclaimer, I haven’t tried it).

4

When going to Bitwarden Web vault I don’t see the option to login with device, AFAIK that’s only after you make the browser a trusted device. As for whether I am able to login with device into the Firefox addon unsure, and I definitely don’t want to logout of that just yet. Having a look at that link right now, and it’s already running into problems (no getCryptoService() for example). Maybe it’s already been patched, but I will see if I can figure something out. Thanks!

5

In the browser extensions, you can bypass the master password requirements for exporting the vault contents. There are instructions for Chrome here, which should also work (with minor adjustments) for Firefox. There is a more advanced, but quicker/simpler method described here, although in Firefox, you must first use the approach explained here to access the Console where the JavaScript code must be entered,

2 Likes
6

That is correct. I was asking because if you are able to login to the web and your account is premium, you could try setting up an emergency contact to recover the lost master password.

No, No!, If you are already logged in on ff web extension you should definitely NOT logout there, you should try what @grb just posted. they seem to be much more detailed instructions than what I posted.

2 Likes
7

CryptoService is now KeyService [Pm-13097] Rename cryptoservice to keyservice and move it to km ownership by quexten · Pull Request #11358 · bitwarden/clients · GitHub. That said, this method is of course not supported, and rather an unintended side-effect.

8

Omg, thank you so much for this!
Followed the steps outlined in your post, the only difference in Firefox is that ‘Sources’ is under ‘Debugger’ and it worked perfectly! Thanks so much. No need to faff about with rooted/unrooted Android phones.

Just to clarify, this json file doesn’t seem to have the keyHash mentioned in your post here right? I know I can easily just create a new Bitwarden Vault now but if I can recover my original password that would save me a little bit of hassle.

Either way, again, thanks so much!

9

@Quexten I tried both of the following in the Firefox background page, but neither modification seemed to work:

bitwardenContainerService.keyService.compareAndUpdateKeyHash = function(a,b) {return true}

UserVerificationService.keyService.compareAndUpdateKeyHash = function(a,b) {return true}

Is there a new class name?

10

No, the JSON export does not have any hashes or keys, only the vault data (minus any file attachments, Trash folder, and Sends).

1 Like
11

It’s compareKeyHash now: [PM-13673] Require UserId In CompareHash Method by justindbaur · Pull Request #11568 · bitwarden/clients · GitHub
Untested:

bitwardenContainerService.keyService.compareKeyHash = function(a,b,c) {return true}
1 Like
12

Thanks! I was confused, because the code still contains several references to this.keyService.compareAndUpdateKeyHash.