Decrypt passwords

[doctiar]

I want to send the logged in username and password information to another application. If I use $bbuserinfo[username] its fine, but the $bbuserinfo[password] is encrypted. Does anyone know how to decrypt the password?

THanks

[assassingod]

It's impossible to decrypt the password. It uses MD5 hash and then salt to add ultimate random encryption.

[Zachery]

Originally Posted by doctiar

I want to send the logged in username and password information to another application. If I use $bbuserinfo[username] its fine, but the $bbuserinfo[password] is encrypted. Does anyone know how to decrypt the password?

THanks

Your best off trying to make your other software work with vBulletin.

[CdaKnight]

Yeah. When you check the password, couldn't you run it through the same scenario as the vB password, and then check the hash that comes out vs the hash that the bbuser[password] brings up?

[assassingod]

No because vB3 uses salt which makes each hash completely random, so passwords are like snowflakes, 2 are never the same

[filburt1]

Originally Posted by doctiar

I want to send the logged in username and password information to another application. If I use $bbuserinfo[username] its fine, but the $bbuserinfo[password] is encrypted. Does anyone know how to decrypt the password?

THanks

It's a hash and is not possible to revert to its original unhashed value. If you want to integrate other software into vB, use a consolidated login form. There is absolutely no reason why you would need to get a user's actual password.

[KuraFire]

Originally Posted by filburt1

It's a hash and is not possible to revert to its original unhashed value. If you want to integrate other software into vB, use a consolidated login form. There is absolutely no reason why you would need to get a user's actual password.

There are plenty of situations where you wouldn't want to encrypt passwords, actually, but vBulletin goes for security above such needs.

Originally Posted by assy

It uses MD5 hash and then salt to add ultimate random encryption.

"ultimate", rather. vB's encryption (which is md5(md5(md5(pass) + salt) + license number) and therefore not entirely flawless at all) is still only moderate compared to the real ultimate encryptions

[assassingod]

I don't appreciate being called 'assy'

[TheComputerGuy]

I found that in vB2 I was able to take the MD5 data and use in to get a password. There is a program that will use all of your CPU power and try to figure out the MD5 encryption.

I will not post it for obvious reasons, but in vB2 there is ways to get the password from the hash as well.

Good to see vB3 did a better job with this.

[RixiuS]

Originally Posted by assassingod

It's impossible to decrypt the password. It uses MD5 hash and then salt to add ultimate random encryption.

MD5 is not breakable though. ;o

Project Rainbowcrack is/are NT/MD5/SHA1 password cracking tables, capable of cracking any of these encryptions in (possibly) a matter of seconds. It has a table generator for every possible password. However there isn't anything as dynamic as you want right now. But probably sometime in the future.

http://www.antsight.com/zsl/rainbowcrack/

Really interesting stuff it is.