MD5 Encrypted Passwords

Being an old-fashioned sysadmin, I feel better in the mornings if I cannot view my user's passwords.

After installing vBulletin, I was disturbed to find that passwords were stored in cleartext. So, I made a couple of modifications, to ensure that only MD5 encrypted passwords were stored in the database.

I didn't think much of it at the time, I was sure someone had released a hack already. When browsing the VB forums, however, I found that a lot of people wanted a solution like mine.

The main issue of concern seemed to be "But now the lost-password function won't work!"

I put in place a random, "pronounceable password generator" I found on PHPBuilder. When a user "loses" their password, a new, random password is generated and emailed to them, and the MD5 encrypted version is saved into the database.

I chose MD5 because I'm fond of the concept of "one-way" encryption.

Now, no admin can see a member's password. :-)

Enjoy!

(Instructions, and a database-update script are included in the .zip file at http://www.coffeeintherain.com/scripts/md5_hack.zip )

[Heineken77]

Has this hack been automatically inserted into vB's v2.0.3 release? I don't see where you can see the passwords anywhere .. encrypted or not!

[Heineken77]

Has this hack been automatically inserted into vB's v2.0.3 release? I don't see where you can see the passwords anywhere .. encrypted or not!

Thanks!!
Heineken77

[pogo]

<font color="red">Heineken77</font> Edit your config.php to be able to see and change passwords.

[pogo]

I updated this hack to 2.0.3

I think I covered every password related part of the script. At least I hope so.

Now you can:
- change your password via usercp
- change the password via cp
- login during reply or new thread

Forgot anything? Please tell me.

Please get the words.txt from the old link!

[Heineken77]

Hey thank you very much for that bro!!

Just a question. What's the harm if admin can see passwords?

Thanks

Originally posted by Heineken77
Hey thank you very much for that bro!!

Just a question. What's the harm if admin can see passwords?

Thanks

I wouldn't feel confortable if the admin can see my passwords. What is some passwords are the same as my banking accounts, etc?

[pogo]

hacker Then you are very, very dumb....

Originally posted by Pogo
hacker Then you are very, very dumb....

Of course not, but if someone has access to the account, from there, he can snoop around and you will never know what info you have left around. There are people who use the same pwds simply because there are too many to remember.

I have a Cisco pix and a Cisco router for home and I encrypt everything...

[Heineken77]

LOL@Bank account hehe

Thanks for the info guys!

[Raptor]

is it at all possible to set this hack up so admin CAN see the passwords but they are still encrypted in the DB ?

and pogo - can i simply overwrite the old version of this hack with your new one ?

i take it i dont have to encrypt the passwords again as of course they are already done