Decrypt passwords
 

I want to send the logged in username and password information to another application. If I use $bbuserinfo[username] its fine, but the $bbuserinfo[password] is encrypted. Does anyone know how to decrypt the password?

THanks

It's impossible to decrypt the password. It uses MD5 hash and then salt to add ultimate random encryption.

Your best off trying to make your other software work with vBulletin.

Yeah. When you check the password, couldn't you run it through the same scenario as the vB password, and then check the hash that comes out vs the hash that the bbuser[password] brings up?

No because vB3 uses salt which makes each hash completely random, so passwords are like snowflakes, 2 are never the same

It's a hash and is not possible to revert to its original unhashed value. If you want to integrate other software into vB, use a consolidated login form. There is absolutely no reason why you would need to get a user's actual password.

There are plenty of situations where you wouldn't want to encrypt passwords, actually, but vBulletin goes for security above such needs.

"ultimate", rather. vB's encryption (which is md5(md5(md5(pass) + salt) + license number) and therefore not entirely flawless at all) is still only moderate compared to the real ultimate encryptions :)

I don't appreciate being called 'assy'

I found that in vB2 I was able to take the MD5 data and use in to get a password. There is a program that will use all of your CPU power and try to figure out the MD5 encryption.

I will not post it for obvious reasons, but in vB2 there is ways to get the password from the hash as well.

Good to see vB3 did a better job with this.

MD5 is not breakable though. ;o

Project Rainbowcrack is/are NT/MD5/SHA1 password cracking tables, capable of cracking any of these encryptions in (possibly) a matter of seconds. It has a table generator for every possible password. However there isn't anything as dynamic as you want right now. But probably sometime in the future.

http://www.antsight.com/zsl/rainbowcrack/

Really interesting stuff it is. :o

Suppose your best method is adding a field to the user table, called 'actualpassword' or something, edit the login page, if login is successfull, update this field to be the data they inputted from the form and not the password stored in the db, seems most sensible way to me :)

But doing this is breaking privacy policy and in some countries it may be illegal

"every possible password" - only conventional ones would fit in that, a password like "xigH9d[3Cu89" would probably not be in those tables ;)