Private Messages Enhancements - PMCrypt - Private Message Encryption

Keywords: Private, Message, PM, Encrypt, Encode, Security

Description:
Encrypts Private Messages within the MySQL database. Allows for on-the-fly decryption without the need for a shared key.


Details:
This hack will encrypt sent messages within your MySQL database. No longer will they be viewable in plaintext, thus affording your members a little more security with their private correspondance.

Please be aware that this is not a total security solution. This was devised with simplicity as well as security in mind -- such as that the encryption method used is NOT to be assumed "unbreakable" by any stretch of the imagination.

The messages are encrypted using a method developed and credited to AITOR SOLOZABAL MERIN by where text is encrypted/decrypted using a simple but powerful XOR method without a known key. Implicitly, the key is defined by the string itself in a character by character way. There are 4 items to compose the unknown key for the character in the algorithim:

1. The ascii code of every character of the string itself
2. The position in the string of the character to encrypt
3. The length of the string that include the character
4. Any special formula added by the programmer to the algorithm to calculate the key to use

This product does not explicitly rely on any vBulletin functions, thus there should not be any problems with future upgrades, etc.

This product was developed by request of FGENETICS and DOOGIE88.


Installation:
1. Download and import the product-pmcrypt1.1.0.xml file via the Product Manager.

2. Enable the product via the AdminCP (vBulletin Options > Private Message Encryption)

3. ???

4. Profit


Version History:
v1.0.0 - Initial Release
v1.0.1 - Fixed bug when replying to an encrypted message.
v1.1.0 - Fixed issue with reply and preview. Encapsulated encryption within base64_encode(); for storage. Smilies no longer run risk of breaking encryption.

* Once enabled, all PM's sent thereafter will be encrypted. This means that should you choose to disable and/or uninstall the product, said PM's will remain encrypted -- rendering them unreadable.

* Please note that this modification was developed on a forum with a userbase of 1 (myself). I've tested it for basic functionality but I cannot guarantee functionality or behavior on your forum. So, please -- make backups before installing this product!

[magnus]

Originally Posted by Mrdby

anybody else?

[cclaerhout]

There is a bug with this product and vBulletin infraction system. When you want to give user some penality points, here is the message :

""please complete both the subject and message fields."

When you desactivate this hack, it works.

[cclaerhout]

Here is a patched version

Warning : once product installed, never delete it otherwise you won't be able to read your pm anymore. Just UPDATE it (there's no problem to do that).

[wIrEs]

why never delete it? is it hard to code an Admin CP option to decrypt ALL messages before deleting this mod ?? over even, decrypt all messages before upgrading for a new version just in case something goes wrong ?, and let's say, also add a PM checkbox to let the user encrypt the message if they want...this is for encrypting sensitive information or if you're going to just say hi to somebody encrypting that kind of messages is pointless in my opinion, anyway cool mod overall but was expecting some more Unhackable' idea. I will use it anyway since before the messages can be cracked, a cracker needs to crack my database LOL.

[cclaerhout]

Well i'm not the coder, but this hack is very usefull when there are several admin and you want to be sure none of them will connect the DB to read PMs. By the way, your idea to decrypt all messages before deleting this mod is really good.

[sub_ubi]

Anyone have this running on 3.7?

[codershark]

works perfect on vb 3.7 Beta 6

[DssCrazy]

Problems

does not work with pm preview.

Does not work with infractions. thanks to cclaerhout it now does.

Does not Encryption the auto welcome message for new sign ups.

If user have their account setup to send to email it will show the Encryption.

Other than that this is WICKED.

Can you fix?

Thanks.

[Martell]

Does not work vB 3.6.8 PL2.

Can you fix?

Thanks.

[DssCrazy]

when is this coming out of beta stage?