Duplicate users/passwords?
 

Would anyone be interested in writing a hack for finding duplicate users?

There was a hack written for this by checking the ip's and the passwords, and if two users matched it would so it.

it wouldnt be a hack so much as a serrious securty issue >.< removing the md5+salts would be the only way to check idential passwords i belive

Hashing can remain with the same password checking, but unique user salts would indeed have to go.

whichs brings up security issues.

now anyone who got the md5 from one site could use it on another vB with the same modifcation made

thus creating an insecure system...

There are no security issues created just by storing passwords even in plain text provided the server(s) is(/are) secured well, and the people who have access to the database are responsible. Granted that will probably not be the ideal aproach in most scenarios, by no way is it just insecure for that.

Whether or not these two (see first sentence) can be aplied to a typical vb user, noting especially how many vbulletins run on shared hosting, that is a whole different story. Do you want to remove an extra safety net in case your well versed technical co-admin places a db backup somewhere without any security (another random example why hashes are there, but note that it does not make not hasing any less secure, it's just significantly harder to "screw up" if the passwords are hashed)?

I'm not asking to see the actual passwords, just the md5 hashes, so if the user has the same ip, and the same password i can assume it is a double user.

There was a hack made before for vb2, all i'm asking is for a vb3 version.

<a href="https://vborg.vbsupport.ru/showthread.php?t=36269" target="_blank">https://vborg.vbsupport.ru/showthread.php?t=36269</a>

We know that ;) However the probability of two users with the same password actually having the same password hash (due to the salt) system is rather slim. This is where the difficulty lies.

What's Salt?

And if it can't be done, then just the same ip would be fine.

the salt is what is generated to dlb encrypt the users password

md5+salt+password and each salt is random