hashing passwords - forgetful users?!

Thread Solved

Join Date: Nov 2007
Posts: 79
Reputation: lifeworks is an unknown quantity at this point 
Solved Threads: 2
lifeworks lifeworks is offline Offline
Junior Poster in Training

hashing passwords - forgetful users?!

 
0
  #1
31 Days Ago
Hi

So story goes, Ive recently started hashing user passwords to protect access, but have come to a bit of a problem in that if a user forgets their password, Im unable to retrieve it for them, because all I have is the salted-md5 hash?

How has everyone else overcome this problem?

lowrks
Reply With Quote Quick reply to this message  
Join Date: Sep 2009
Posts: 521
Reputation: network18 is an unknown quantity at this point 
Solved Threads: 60
network18 network18 is offline Offline
Posting Pro
 
0
  #2
31 Days Ago
its not possible the crack the md5 encrypted string , because its an one sided encryption.
Its been done with the huge database actually. Have a look at this -
http://md5crack.com/crackmd5.php
Last edited by network18; 31 Days Ago at 3:48 am.
Reply With Quote Quick reply to this message  
Join Date: Jun 2007
Posts: 1,227
Reputation: kkeith29 has a spectacular aura about kkeith29 has a spectacular aura about kkeith29 has a spectacular aura about 
Solved Threads: 167
kkeith29's Avatar
kkeith29 kkeith29 is offline Offline
Nearly a Posting Virtuoso
 
0
  #3
31 Days Ago
You need to understand that a salted hash is irreversible (without the original text and salt). Thats the point of it.

You either need to generate them a new password and send it to them or give them access to a reset password page on your site.

By the reset password page, I mean you need to send them a link with a unique code only for them. I also set a cookie with another random string and compare the two with the database entry. If they match then they put in their new password.
Google is your friend.

Use [code] tags.

If you have found a solution to your problem, please mark the thread as SOLVED.
Reply With Quote Quick reply to this message  
Join Date: Nov 2007
Posts: 79
Reputation: lifeworks is an unknown quantity at this point 
Solved Threads: 2
lifeworks lifeworks is offline Offline
Junior Poster in Training
 
0
  #4
31 Days Ago
cool, i do understand that md5 is irreversible, just wondering what the conventional solution is. Thanks for the help - I think i will go the 'generate them a new password route'.

lworks
Reply With Quote Quick reply to this message  
Join Date: Oct 2009
Posts: 24
Reputation: liamfriel is an unknown quantity at this point 
Solved Threads: 1
liamfriel's Avatar
liamfriel liamfriel is offline Offline
Newbie Poster
 
0
  #5
31 Days Ago
There isn't an effective way to do this.

The best way would allow the users to reset their password and send them a copy via email.

I was pretty new to php when I made this but you can make your own adjustments.

  1. <?php
  2. //3 arrays of random numbers and letters
  3. $caps = array("A", "B", "C", "D", "E", "F");
  4. $lcase = array("a", "b", "c", "d", "e", "f");
  5. $num = array("1", "2", "3", "4", "5", "6");
  6.  
  7. //radnomly generate a password using caps, lcase & num
  8. $char1 = $caps[round(rand(-0.4, 5.4))];
  9. $char2 = $lcase[round(rand(-0.4, 5.4))];
  10. $char3 = $num[(round(rand(-0.4, 5.4)))];
  11. $char4 = $caps[round(rand(-0.4, 5.4))];
  12. $char5 = $num[(round(rand(-0.4, 5.4)))];
  13. $char6 = $lcase[round(rand(-0.4, 5.4))];
  14. $char7 = $caps[round(rand(-0.4, 5.4))];
  15. $char8 = $num[round(rand(-0.4, 5.4))];
  16.  
  17. $newpassword = $char1.$char2.$char3.$char4.$char5.$char6.$char7.$char8;
  18.  
  19. //this is just to make md5 more secure, you may want to remove this if you dont add anything to your passwords.
  20. $randomword = "salt";
  21. $safepword = md5($newpassword.$randomword);

email them with $newpassword & add safepword to your Database.
Last edited by liamfriel; 31 Days Ago at 9:46 am.
They throw us away like yesterdays jam - Maurice Mossley

Please - rep if someone helps you, it can't be traded for stuff, but it's nice.
Reply With Quote Quick reply to this message  
Reply

Tags
crack, md5, passwords

This thread has been marked solved.
Perhaps start a new thread instead?
Message:



Similar Threads
Other Threads in the PHP Forum
Thread Tools Search this Thread



About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC