This is probably a MySQL question as much as it is a PHP question but mostly it is just a logic question.

Okay, here it is...I have a site with many password protected pages. When a new user is added, their password is hashed and stored in the database using the PASSWORD() function.

...WHERE password = PASSWORD($password);

Then when the user logs in, we compare the hashed value of what they submitted in the password field with the hashed value stored in the database. This seems pretty smart and pretty secure as no actual passwords are stored in the database.

Now, my real question is, how does one develop a password recovery system (i.e. user has forgotten his password and needs it emailed to them) while this logic is in place? It doesn't look like I can decode the hashed password in the database. Do I need to start from scatch with how I deal with passwords?

I appreciate any and all input on this

    In one approach you could not necessarily e-mail the user the old password, but a new, temporary one, as long as he/she enters the e-mail used for registration (you can use the md5() function for that).
    The idea is that that user and only that has access to his/her e-mail account.
    This way, you get away with password generation and e-mailing, then the user will change the temporary password wih one to its liking.

      How is it that some systems are able to retrieve your actual password (perhaps not via email but after answering a series of identifying questions)?

        I'm thinking that MD5 is a one-way hashing function, so, even if cracking such hashes is possible, it wouldn't be feasible for a site (like the ones you mention) to e-mail back a cracked hash in fact.
        So my guess is that they use different encryption algorithms, easily reversible ones and have, in turn, some other form of security to prevent trivial access to the encrypted passwords. Or, maybe they store the plaintext into encrypted databases.
        However, this is just a thought of mine and shouldn't be taken for granted. If someone has more info, I would be interested too.

        EDIT: Look at this page, the des/aes_encrypt and des/aes_decrypt especially.

        AES_ENCRYPT() and AES_DECRYPT() can be considered the most cryptographically secure encryption functions currently available in MySQL.

          suomynonA wrote:

          I'm thinking that MD5 is a one-way hashing function

          you are correct.

          You can retrive the password by

          A: use a less secure method (base64) and create a random key to be appended to the encrypted password, save both the random key and the encryted password WITH the random key appended to mysql db,

          When you need to decrypt the password. remove the random key, then use base64 decode,

          you have the password in a readable form..

          maybe base64 is not the answer but its was the first encrytp/decrypt function that came to mind.

          also for a further read check out.....
          http://phpsec.org/articles/2005/password-hashing.html

          hope this shed some light for you.

          lozza

            Okay, so everything I am reading is suggesting that I use MD5 and then authenticating the users by comparing the hashes. So, am I out of luck on developing any secure password retrieval system for a user who has forgotten their password?

            Does anyone out there run a password protected site who has anything to add?

            Thanks,

              I run several password protected sites, and I find that if a user has not visited the site long enough to have forgotten their password, it's probably a good time for them to create a new one.

              I would highly recommend using MD5() encryption for password storage and comparison, use a password reset system, and generate a new random password for the user if they request a reset.

              However, if you insist on a password recovery system, use a strong reversible encryption like suomynonA recommended, and implement a robust validation system when a user requests a password recovery. Use things like a secret question and / or a validation code embedded in an image.

                Thanks for the information. I think I will do as you suggest and create a password reset system and generate a new random password if the user requests a reset.

                Thanks again!

                Scott

                  Write a Reply...