UBB.threads PHP Forum Software Community Forums UBB.threads Version 7/8 Support User Passwords Encrypted

I am writing a custom page for a website that will be checking to make sure a particular user has registered with the website. How can I check to make sure the password they enter is the same password? How do I unecrypt it to check? Was it encrypted using MD5 or is it a proprietary board encryption?

You can't check and confirm it as that would make it too easy for someone else to do the same and break everyone's password.

nt,

you can check any forum software's user/pass with a query and knowing how to do it. how do you think they handle the login screen ?

we probably won't publish a howto here though

Haelix, i'd suggest you look over @ ubbdev though and look for Ian Spence's thread on including a user_auth.php file to determine whether a user is 'valid' and much much more.

it's self explanatory over there, so give it a looksee

MD5 is no encryption, it makes a fingerprint of a block of data.

Encryption is reversable, MD5 is not.

There are numerous MD5 decoding (dictionary) sites online that I've found can get through even my random 18character password quite fast... MD5 is only (even partially) secure if one where to dual salt it and md5 it twice (as CC suggested would be in .t7 during writeup).

As for checking, compare user input string to string in db; easy enough.

all true, but still, fact of the matter is, MD5 not an encryption

I can't get an original 10 gig sized picture back when I just got the MD5 of it.

Lol agreed, encode != encrypt

But what would be the actual risks with the current system?

as in, when the database gets out on the street vs the risk of a local cookie being hacked.

Like i said, there are md5 dictionary sites online; plain md5ed passwords can be looked up with 0 problem.

well, I tried a few of those sites with all the admin MD5's a while back, and got zero hits. It's a security check I do once in a while.

lol,

if a hacker gets to the point where he is looking @ md5'd psws he doesn't even need to know what i represented prior to encode.

he'd just write his md5 into whatever psw field and login with user/plain text psw.

matter of fact, i've had to self hack my blog that way. i forgot my initial admin psw, so i just logged into phpmyadmin and slammed a known md5 in there.

so i don't get why having lists of md5's on the internet compromises a site's login system.

well, that simply means that their dictionary doens't have your password in it (yet); you'll notice that not all sites use the same dictionary

and when they have an md5 on the net that matches the one for my password, how am i now compromised ?

they still haven't put it together that that md5 is my password. they only put out what 'xxxyyyzzz' looks like when it's md5'd

Well, a lot of user use the same passwords everywhere; so if you got ahold of SiteA's md5 hash of a user password, their email is out the window...

I'm not saying how you'd get this, as I have nada clue, I'm simply stating that just relying on MD5 as your only security on passwords you're not doing too good of a job... Most other solutions (going off of a convo "elsewhere") do more than a simple md5($password), they go as far as md5(md5($salt . $password . $pepper))

BTW, before SD goes off on a tangient trying to prove me wrong on how LOGIN SYSTEMS DO INDEED WORK PROPERLY (and make me feel like crap yet again) I'd like to simply state that I'm stating that the STORAGE OF PASSWORDS in md5 isn't the "end all be all" for security here; which again I feel we're going off in two differant areas in this one conversation (as per usual)

you missed where i was going with it, but that's ok.

i simply meant that a guy staring at your DB (2 posts ago) at a mysql prompt isn't going to be worried too much about how things are encoded. you're screwed at that point.

as to md5 vs md5 + salt, sure salt > no salt. i'm not defending the login procedure here, nor why we only use md5 in v7.x.

so if you want to think i'm coming down hard on you, then you might just be mis-reading my posts.

see, again, misscommunication as always ...

BTW, I've seen insecure setups that would allow users to both read and overwrite data, but I've also seen the same instance where a user will just read out staff passwords and retain access until a point where they want their mischievious actions to be seen...

I've also seen people store backups in "temporary"/"unsafe" locations which would provide someone access to their user passwords without the ability to change the passwords (which was where I was going with this)

Well I know that but that is more my point. I've been around for a long time now in the computing World and there just isn't much that is secure if someone really wants to get it, but I've also come across more than my fair share of noobies basically fishing for ideas on how to crack other peoples passwords and I'm not going to tell them how even though it can be done.