more on password extraction