[agallian86]

Originally Posted by Dismounted

Problems List

1./ vBulletin "zaps" (encrypts) the password before it even gets to the server, making it impossible to capture without changing a heap of things.
2./ Even if you did get past that, anyone could login as anyone and gain control of their account...

1. Why couldn't I just change the calls from md5 to sha? and/or add funtionality to the checking? (check against md5 and sha hash)

2. No, they couldn't. It would check their pw against the hash stored on the db, first as an md5 and if it didn't match try to hash it as a sha and if that didn't match then your login failed, if it did match then you store it as an md5 hash so it doesn't need to be compared each time as md5 then sha (i.e. usual vbulletin functionality).

I've been told specifically by vbulletin staff that it would work and not take tons of effort, trouble is, I don't have the faintest idea of how to code it and they're not authorized to help with code modification, and I know someone here can help point to the right direction.