|
|
#52655
03/20/2002 2:07 PM
|
Joined: Mar 2001
Posts: 117
Member
|
|
Member
Joined: Mar 2001
Posts: 117 |
can anyone encrypt the passwords when stored in the 00000xxx.cgi files?
|
|
|
#52656
03/20/2002 2:35 PM
|
Joined: Sep 2001
Posts: 170
Member
|
|
Member
Joined: Sep 2001
Posts: 170 |
Why would you want this? I understand some admins don't think its right to be able to see users passwords, but they are warned we can when they register.
In my view, I payed for the board, I work hard to maintain it and constantly upgrade it, so Its my board. I feel have the right to look at any and all information on my board, if the user is uncomfortable with that then they need to stay off my board.
|
|
|
#52657
03/20/2002 4:14 PM
|
Joined: May 2001
Posts: 10
Junior Member
|
|
Junior Member
Joined: May 2001
Posts: 10 |
But for securtiy is better the passes are crypted.
I think its a big security hole that the passes are stored uncrypted. And why a admin must read the user passes?
bye
Erkman
|
|
|
#52658
03/21/2002 12:25 AM
|
Joined: Apr 2001
Posts: 73
Member
|
|
Member
Joined: Apr 2001
Posts: 73 |
The actual passwords have to be stored somewhere. What if for some reason you NEED to get someone's pass, but can't because it's encrypted? Plus where would the the passwords be stored?
|
|
|
#52659
03/21/2002 1:15 AM
|
Joined: Mar 2001
Posts: 117
Member
|
|
Member
Joined: Mar 2001
Posts: 117 |
Assume that it's ok to see the password if I am an Admin.
Assume that someone other than has the admin has stolen the user database files (00000xxx.cgi)
Assume that there is a way for the admin to set a PGP key (or whatever other customizable encryption method which only the admin knows)
Assume that the user passwords are encrypt in this way.
Then
The guy who stole the user database files cannot know the password.
Just for safety reason...
|
|
|
#52660
03/30/2002 12:14 AM
|
Joined: Jun 2000
Posts: 150
Member
|
|
Member
Joined: Jun 2000
Posts: 150 |
if you just moved your members files to a place where they are inaccessable to the web, but accessable to your site, IE, above web root, then you are fine.
plus if you are encrypting the passwords then you need to be able to decrypt them in may different places too.
|
|
|
#52661
03/30/2002 9:49 AM
|
Joined: Mar 2002
Posts: 8
Junior Member
|
|
Junior Member
Joined: Mar 2002
Posts: 8 |
its very well possible to make it use crypted passes, vbb does that too.
but, if u have encrypted passwords, u can still fake cookies and get into their account
|
|
|
#52662
04/02/2002 4:19 AM
|
Joined: Jun 2000
Posts: 150
Member
|
|
Member
Joined: Jun 2000
Posts: 150 |
yeah vbb has it
but php has a nice fast encode and decode function that it uses for the passwords.
no reason to slow down a perla/4.ed board any more then it needs to be.
|
|
|
Donate to UBBDev today to help aid in Operational, Server and Script Maintenance, and Development costs.
Please also see our parent organization VNC Web Services if you're in the need of a new UBB.threads Install or Upgrade, Site/Server Migrations, or Security and Coding Services.
|
|
|
Posts: 417
Joined: November 2001
|
|
|
Forums63
Topics37,575
Posts293,930
Members13,823
| |
Most Online6,139
Sep 21st, 2024
|
|
Currently Online
Topics Created
Posts Made
Users Online
Birthdays
|
|
|
|
|
|
