23 replies to this topic

[Korndawg]

I was wondering if there was a way that you can get md5 to reverse its coding and give you the original password? The reason I want this is because when I have users sign up, they enter the password they want and my code converts it using md5. However, im making an update section and I would like the input value to have the original password. Is this possible?

[Mr. Matt]

no u cannot undo MD5. Displaying the value itself there is a security risk in its own. If you are having a profile update section, have 2 different bits, the main update and a change password function.

You get them to insert their original password, and 2 copies of the new one, and md5 their original one and check it against the value stored in the database. And I am sure you can work the rest out for yourself.

Matt

[Korndawg]

Ok Matt, thanks for the information!

[Av-]

why encode it anyway?

[Matthew.]

Avalanche, you mean why encrypt a password? That's pretty self explanatory ....

[Av-]

yea, i ment encrypt, but still, i always do it, but i dont really see the point, once its in the database who can touch it?

[Mr. Matt]

well if you have a poor system in place, someone injects your database and sends all the user account details to themself, you have everyones password in plain text.

Does that answer you?

Matt

[Av-]

yes, but assuming you DO have your databse protected right, whats the point?

[Chris.]

lol all you have to do to really protect your database is, say you have something like a register page, and you wanna protect it from SQL Injection. You would just set your variable something like

$username = $_POST['username'];

and to protect it you would just

$username = htmlspecialchars($_POST['username']); or something like that

[Matthew.]

Just do:

addslashes( stripslashes( mixed value ) )

And Avalanche (and deadly) its not limited to injection, on a ridiculous amount of hosts you can actually use a simple one line command to get a full backup of anyone on that servers files. Ok a little overstatement but it can be done.

I mean you always encrypt anything sensitive, its just....standard

The question you ask yourself is avalanche: Why not?

I always double hash using sha1 and md5 btw

Edited by Matthew., 23 September 2006 - 05:23 PM.

[Chaos King]

I encrypt my passwords with their userID, the time they registered and their password hash. And some other goodies as well. Just depends on whos site I am coding

[Chris.]

so, if you entered a password into a database in md5 hash, then you can't make a "forgot password" script that sends them their password?

[Dabu]

Chris., on Sep 23 2006, 10:00 PM, said:

so, if you entered a password into a database in md5 hash, then you can't make a "forgot password" script that sends them their password?

Yes and No. You can create a "I Forgot My Password" script, but instead of sending the user it's current password, you would have to have the script generate a new one.

[Chris.]

well, i would like it if it sends them their current password there is a site that decrypts md5 hash, but it won't give the source code. here it is http://www.md5decrypter.com/ can someone tell me how they do that?

[Hayden]

Chris., on Sep 23 2006, 11:44 PM, said:

well, i would like it if it sends them their current password there is a site that decrypts md5 hash, but it won't give the source code. here it is http://www.md5decrypter.com/ can someone tell me how they do that?

dunno, but it's encouragement enough for me to start doing something like Matt or Chaos, or a combination of the 2.

[Matthew.]

The site is bogus lol.

You cant decrypt md5 you can either dictionary list it (where a database of current md5s and their value are compared to the entered hash - which iswhat that site does) or you can brute force it which takes days if not weeks for just 1 hash.

Edited by Matthew., 24 September 2006 - 07:50 AM.

[Av-]

yeah, the site uses a database, you can test it, heres the md5 hash for 'roflcopterlmao' (), 2a805e47611d9c33420b33435a15f919, try it, its not going to work

[Crofty]

i thought md5decrypter worked by them entering words into there database and having the md5 hash aswell so when you enter a md5 it searches the database for the hash and if it finds it brings back the word.

Edited by Crofty, 24 September 2006 - 07:32 AM.

[Matthew.]

That is how it works...

[Crofty]

dam that must be boring tho just entering words into the database prob make your brain hurt aswell thinking of words