Hacker News Reader

Comment by johndandison | Hacker News Reader

There are ways to extract passwords from iOS backups, that might be a way to go? I believe the entire keychain could be accessed.

View on HN

I tried Keychain Viewer package from a 3rd party repo on Cydia. It didn't get the Yahoo password unfortunately. If you know of any specific packages to try, please let me know. I got so angry when she said 'I will not give you my name. There is no manager here. Goodbye' that I threw my iPhone at the wall and shattered it to pieces. Now I'm also out $400. I really hate Yahoo .. :-/

Well that was a bit silly.

For real. Just cost myself $400. I have anger problems.

There is an app called Keychain Access on the mac which allows you to copy a password to the clipboard. If they're using iCloud keychain and they can login to their iCloud account, you might be able to pull it off that way.

That's what I did when the same happened to me. Enable iCloud Keychain on the iPad and the Mac, wait for the passwords to sync (might take a few minutes) and then open Keychain Access on the Mac and find the password on it.

This did not work because the Yahoo password is not stored on the device after being entered. Apparently Yahoo has something called XYMCOOKIE authentication for SMTP and IMAP which is basically just acceptance of a pre-sent hash/cookie. The iPad discards the actual password the first time you enter it and instead stores a XYMCOOKIE.

See here: https://www.google.com/search?q=XYMCOOKIE+authentication

Oh, I figured they had used Safari but it makes sense that they used the builtin Mail app.

This won't work. Yahoo credentials are stored for later use as "XYMCOOKIE" which is some kind of hashed authentication mechanism for SMTP and IMAP. And yes, I tried. I also attempted to monitor SSL communications through SMTP and saw the XYMCOOKIE exchange firsthand. This sucks :-/

Or at the very least set up forwarding in case you can't get back to your account!

Reply on news.ycombinator.com