Reset Passwords for All Users?
 

Is there a way I can reset the passwords for all users and then send them all and email letting them know how to proceed?

Phpmyadmin, go to the user table, drop the password column, then add it back, with the same details (varchar32, adjust priv's etc....)

Mass mail your users with this:

Hello $username,

We have recently had a issue with the site, please reset your password via the link below.

http://www.yoursite.com/forum/login.php?do=lostpw&email=$email

Thanks Staff

For some that might be a bit "much" and they could potentially mess up the table if they don't add it back properly.

I would instead run this query:
Be sure to change the primary Admin password if userid = 1 before anything IF you've been hacked/compromised.

Now everyone's password is:
DON'T TELL THEM THAT THOUGH, now simply email as Snakes said to all members and let them know to request a password reset, once they do a password request reset it will reset their password. Before you run the query replace HibbityJibbityBl@hBl@h with a long password of your own that no one would know.

I've used this in the past when I had to reset all passwords and email all users on one of my vb4 boards.

https://vborg.vbsupport.ru/showthrea...904#post479904

I would expand on this to say this needs to be done for all administrators/staff accounts, regardless of how much access they have. And enforcing a 2FA solution (at least on staff accounts including administrators and moderators) such as Google Authenticator also goes a long way when it comes to protecting your users and website from malicious users.

is there a good 2FA modification that exists?

For vB4, yes. I used to use a modification that I wrote myself, however as it's not commercially available (and likely never will be) I would suggest looking at DBTech Two Factor Authentication. This should achieve the same as what my own plugin did. 2FA really beefs up the security of your platform when used correctly!

It's probably not a great idea to set everyone's password to the same thing, no matter how obscure.

This is probably a better idea:

This basically invalidates everyone's password (except for userid 1). No one will be able to authenticate until they go through the password reset process and select a new password.