POP3/IMAP password encoding

2 Feb 2005 1:12 PM

Cristian Iorga

Hi everyone,

I'm trying to develop a tool that setups ready to be used MAPI profiles for
Outlook 2k/XP/2k3. The only problem left is setting up the password for the
transport providers. I couldn't find any properties, procedures or
workaround for this, so the question would be if anyone knows any
programmatic way to setup the POP3/IMAP password using MAPI for the
transport provider?

Another method to setup the password seem to be by encoding the data
directly into the registry (can have a look at
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
Messaging
Subsystem\Profiles\%profile_name%\9375CFF0413111d3B88A00104B2A6676\00000002\POP3
Password) but I couldn't find any documentation/information of how Outlook
encodes the password. It seems to be encoded using CryptoAPI provided by the
operation system, but starting with Outlook 2000, each Outlook version
installs another Cryptographic Service Provider (ExchCSP.dll). The question
would be if you have anyone has any information/idea if Outlook is using
EschCSP or CryptoAPI alone to encode/decode the password. Also, does anyone
know the encoding algorithm used from CSP and/or password used to encode the
data?

Other methods tested on to setup the password that didn't worked were by
using .prf files imported into Outlook (no way to setup account password),
using Microsoft provided tools to create profiles (only creates services and
providers, bot accounts).

Thank you!

Best regards,

~Cristian

2 Feb 2005 1:55 PM

Sue Mosher [MVP-Outlook]

AFAIK, it is not possible to set mail account passwords programmatically.

--
Sue Mosher, Outlook MVP
Author of
     Microsoft Outlook Programming - Jumpstart for
     Administrators, Power Users, and Developers
     http://www.outlookcode.com/jumpstart.aspx

Show quoteHide quote

"Cristian Iorga" <ciorga@newsgroup.nospam> wrote in message
news:%23gAeRlSCFHA.1296@TK2MSFTNGP10.phx.gbl...
> Hi everyone,
>
> I'm trying to develop a tool that setups ready to be used MAPI profiles
> for Outlook 2k/XP/2k3. The only problem left is setting up the password
> for the transport providers. I couldn't find any properties, procedures or
> workaround for this, so the question would be if anyone knows any
> programmatic way to setup the POP3/IMAP password using MAPI for the
> transport provider?
>
>
> Another method to setup the password seem to be by encoding the data
> directly into the registry (can have a look at
> HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
> Messaging
> Subsystem\Profiles\%profile_name%\9375CFF0413111d3B88A00104B2A6676\00000002\POP3
> Password) but I couldn't find any documentation/information of how Outlook
> encodes the password. It seems to be encoded using CryptoAPI provided by
> the operation system, but starting with Outlook 2000, each Outlook version
> installs another Cryptographic Service Provider (ExchCSP.dll). The
> question would be if you have anyone has any information/idea if Outlook
> is using EschCSP or CryptoAPI alone to encode/decode the password. Also,
> does anyone know the encoding algorithm used from CSP and/or password used
> to encode the data?
>
>
> Other methods tested on to setup the password that didn't worked were by
> using .prf files imported into Outlook (no way to setup account password),
> using Microsoft provided tools to create profiles (only creates services
> and providers, bot accounts).
>
>
> Thank you!
>
>
> Best regards,
>
> ~Cristian
>
>
>

2 Feb 2005 4:07 PM

Cristian Iorga

But there are methods to decode the password progammatically because Outlook
does it and that's enough for me. Hack or not, there is a way to do it.

Please see Mail PassView - http://www.nirsoft.net/utils/mailpv.html. It
decodes the password. So, it must be a way to encode it back. Also, products
like ProfileMaker from AutoProf (recently know as DesktopStandard
Corporation - http://www.desktopstandard.com) does just that.

Regards,
~Cristian

Show quoteHide quote

"Sue Mosher [MVP-Outlook]" <sue***@outlookcode.com> wrote in message
news:Om16XATCFHA.1392@tk2msftngp13.phx.gbl...
> AFAIK, it is not possible to set mail account passwords programmatically.
>
> --
> Sue Mosher, Outlook MVP
> Author of
>     Microsoft Outlook Programming - Jumpstart for
>     Administrators, Power Users, and Developers
>     http://www.outlookcode.com/jumpstart.aspx
>
>
> "Cristian Iorga" <ciorga@newsgroup.nospam> wrote in message
> news:%23gAeRlSCFHA.1296@TK2MSFTNGP10.phx.gbl...
>> Hi everyone,
>>
>> I'm trying to develop a tool that setups ready to be used MAPI profiles
>> for Outlook 2k/XP/2k3. The only problem left is setting up the password
>> for the transport providers. I couldn't find any properties, procedures
>> or workaround for this, so the question would be if anyone knows any
>> programmatic way to setup the POP3/IMAP password using MAPI for the
>> transport provider?
>>
>>
>> Another method to setup the password seem to be by encoding the data
>> directly into the registry (can have a look at
>> HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
>> Messaging
>> Subsystem\Profiles\%profile_name%\9375CFF0413111d3B88A00104B2A6676\00000002\POP3
>> Password) but I couldn't find any documentation/information of how
>> Outlook encodes the password. It seems to be encoded using CryptoAPI
>> provided by the operation system, but starting with Outlook 2000, each
>> Outlook version installs another Cryptographic Service Provider
>> (ExchCSP.dll). The question would be if you have anyone has any
>> information/idea if Outlook is using EschCSP or CryptoAPI alone to
>> encode/decode the password. Also, does anyone know the encoding algorithm
>> used from CSP and/or password used to encode the data?
>>
>>
>> Other methods tested on to setup the password that didn't worked were by
>> using .prf files imported into Outlook (no way to setup account
>> password), using Microsoft provided tools to create profiles (only
>> creates services and providers, bot accounts).
>>
>>
>> Thank you!
>>
>>
>> Best regards,
>>
>> ~Cristian
>>
>>
>>
>
>

2 Feb 2005 4:23 PM

Jason

"Cristian Iorga" <ciorga@newsgroup.nospam> wrote in message
news:O%23oYtFUCFHA.2540@TK2MSFTNGP09.phx.gbl...
> But there are methods to decode the password progammatically because
> Outlook does it and that's enough for me. Hack or not, there is a way to
> do it.
>
> Please see Mail PassView - http://www.nirsoft.net/utils/mailpv.html. It
> decodes the password. So, it must be a way to encode it back. Also,
> products like ProfileMaker from AutoProf (recently know as DesktopStandard
> Corporation - http://www.desktopstandard.com) does just that.
>

If you are a known and large company you can pay Microsoft
a small fortune and get access to do things like ProfileMaker is.
You probably don't qualify....

2 Feb 2005 4:23 PM

Jim Vierra

I think you will find that it is one of the encryption formats like MD5 or
DES possibly from the crypto API. I would try looking at this to see if I
could generat a password that matches the one done by Outlook. The problem
will be the seed if one is used.

--
Jim Vierra

Show quoteHide quote

"Cristian Iorga" <ciorga@newsgroup.nospam> wrote in message
news:O%23oYtFUCFHA.2540@TK2MSFTNGP09.phx.gbl...
> But there are methods to decode the password progammatically because
> Outlook does it and that's enough for me. Hack or not, there is a way to
> do it.
>
> Please see Mail PassView - http://www.nirsoft.net/utils/mailpv.html. It
> decodes the password. So, it must be a way to encode it back. Also,
> products like ProfileMaker from AutoProf (recently know as DesktopStandard
> Corporation - http://www.desktopstandard.com) does just that.
>
> Regards,
> ~Cristian
>
> "Sue Mosher [MVP-Outlook]" <sue***@outlookcode.com> wrote in message
> news:Om16XATCFHA.1392@tk2msftngp13.phx.gbl...
>> AFAIK, it is not possible to set mail account passwords programmatically.
>>
>> --
>> Sue Mosher, Outlook MVP
>> Author of
>>     Microsoft Outlook Programming - Jumpstart for
>>     Administrators, Power Users, and Developers
>>     http://www.outlookcode.com/jumpstart.aspx
>>
>>
>> "Cristian Iorga" <ciorga@newsgroup.nospam> wrote in message
>> news:%23gAeRlSCFHA.1296@TK2MSFTNGP10.phx.gbl...
>>> Hi everyone,
>>>
>>> I'm trying to develop a tool that setups ready to be used MAPI profiles
>>> for Outlook 2k/XP/2k3. The only problem left is setting up the password
>>> for the transport providers. I couldn't find any properties, procedures
>>> or workaround for this, so the question would be if anyone knows any
>>> programmatic way to setup the POP3/IMAP password using MAPI for the
>>> transport provider?
>>>
>>>
>>> Another method to setup the password seem to be by encoding the data
>>> directly into the registry (can have a look at
>>> HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
>>> Messaging
>>> Subsystem\Profiles\%profile_name%\9375CFF0413111d3B88A00104B2A6676\00000002\POP3
>>> Password) but I couldn't find any documentation/information of how
>>> Outlook encodes the password. It seems to be encoded using CryptoAPI
>>> provided by the operation system, but starting with Outlook 2000, each
>>> Outlook version installs another Cryptographic Service Provider
>>> (ExchCSP.dll). The question would be if you have anyone has any
>>> information/idea if Outlook is using EschCSP or CryptoAPI alone to
>>> encode/decode the password. Also, does anyone know the encoding
>>> algorithm used from CSP and/or password used to encode the data?
>>>
>>>
>>> Other methods tested on to setup the password that didn't worked were by
>>> using .prf files imported into Outlook (no way to setup account
>>> password), using Microsoft provided tools to create profiles (only
>>> creates services and providers, bot accounts).
>>>
>>>
>>> Thank you!
>>>
>>>
>>> Best regards,
>>>
>>> ~Cristian
>>>
>>>
>>>
>>
>>
>
>