MD5 Encrypted Passwords

Being an old-fashioned sysadmin, I feel better in the mornings if I cannot view my user's passwords.

After installing vBulletin, I was disturbed to find that passwords were stored in cleartext. So, I made a couple of modifications, to ensure that only MD5 encrypted passwords were stored in the database.

I didn't think much of it at the time, I was sure someone had released a hack already. When browsing the VB forums, however, I found that a lot of people wanted a solution like mine.

The main issue of concern seemed to be "But now the lost-password function won't work!"

I put in place a random, "pronounceable password generator" I found on PHPBuilder. When a user "loses" their password, a new, random password is generated and emailed to them, and the MD5 encrypted version is saved into the database.

I chose MD5 because I'm fond of the concept of "one-way" encryption.

Now, no admin can see a member's password. :-)

Enjoy!

(Instructions, and a database-update script are included in the .zip file at http://www.coffeeintherain.com/scripts/md5_hack.zip )

[CoffeeMugDude]

OK, I'll look at updating the hack this evening...

Umm.. Do you mean that when you access your CP, you are asked for your password, although you are cookied for the normal forums?

My VB has always behaved that way, but if it's optional, I'd suspect that it relates to cookies

correct
i think it's supposed to log you in right away if you're cookied... i'm only 99% sure

[CoffeeMugDude]

Hmm...

I seem to remember reading somewhere about changing the cookie path if your VB path is not your domain. (I.e. "blahblah.com/forums/") I'd fiddle with that.

my forums are like this:
forums.myserver.com
i think you only change the cookie path thing in the control panel if you have server.com/forums1 and server.com/forums2 because then the cookie would be overwritten

[WebMasterAJ]

Hello all,

I installed the hack, and I am having a very strange problem. First, let me state that all the passwords are encrypted, and I can login.

However, I can not login to the admin! When I put in the correct user name and password, it just refreshes the page. However, if I put in an incorrect password, it tells me that its incorrect.

Again, I can login to anyplace on the boards except for the admin... please help!!

Thanks!

[DarkReaper]

I'm having that same exact problem. I'm using the old version of the hack, as I like it not to use dictionary words(not nearly as easy to hack) and it won't let me into the admin CP. Same thing as him, if my password is right, it refreshes the page, if its wrong, it says so...what's with this?

[rebby]

does anybody know if this is working it's way into vb 2.0.4 (or later) versions???

encrypted passwords are really the only way to go... i'm not sure why this wasn't the original scheme???

[Raptor]

could Coffeemugdude please post instructions how to de-install this hack

of course easy to revert script changes but what about decrypting all the passwords within the database so it puts everything back to the way it was before ?

[rylin]

[QUOTE]Originally posted by Raptor
could Coffeemugdude please post instructions how to de-install this hack

of course easy to revert script changes but what about decrypting all the passwords within the database so it puts everything back to the way it was before ?

[DarkReaper]

The whole point of this is so that no-one can find the passwords if they're encrypted. If they could be decrypted, wouldn't that defeat the point?