Encrypting existing pwds

This is the place to report bugs and get support. When posting in this forum, please always provide as much detail as possible.

Please do not report problems with a custom build or custom code in this forum. If you are producing your own build from the source code and have problems or questions, ask in the developer forum, do not report it as a bug.

This is the place to report bugs and get support

When posting in this forum, please try to provide as many relevant details as possible. Particularly the following:

  • What operating system were you running when the bug appeared?
  • What database platform is your site using?
  • What version of mojoPortal are you running?
  • What version of .NET do you use?
  • What steps are necessary to reproduce the issue? Compare expected results vs actual results.
Please do not report problems with a custom build or custom code in this forum. If you are producing your own build from the source code and have problems or questions, ask in the developer forum.
This thread is closed to new posts. You must sign in to post in the forums.
2/21/2006 2:51:13 AM
Gravatar
Total Posts 22

Encrypting existing pwds

Last night I changed my site settings by turning on password encryption.  Now I can't log in.  I assumed that pwds that worked would continue to work.  Did I miss something?

Thanks in advance - Craig.

2/21/2006 1:27:12 PM
Gravatar
Total Posts 18439

Re: Encrypting existing pwds

Hi Craig,

Yeah there is some information on that here:
http://www.mojoportal.com/security.aspx

I hope you have a way of connecting directly to the db to solve this problem. First set it back to not require encryption your old password shoud still be there and you should be able to login again.

Then login as Admin. Its been a while since I've reviewed this functionality but I think what you need to do is reset your admin password while you are still logged in after making this change this will remove your clear text password and create a random one encrypted, once you login again you can change it to what you want.

To be safe you could make a second admin user while still logged in after this change, then on a different computer make sure the new admin can login before you logout in case you need to revert.

Then again as long as you have way to connect directly to the db you can always set the site back to non encrypted and key a new password in the db if it doesn't work.

The current model uses one way encryption so you can't decrypt it. When a user logs in it encrypts the password he types and compares to the encrypted password in the db.

In the future I may change to 2 way encyption which would allow password recovery. This has been more challenging to implement in the past because you have to store the private key somewhere safe. In .NET 2.0 things are little easier we could use an RSA Key pair and encrypt the keys in the web.config using a machine key.

Hope that gets you back in business.

Cheers,

Joe
2/21/2006 5:08:15 PM
Gravatar
Total Posts 22

Re: Encrypting existing pwds

Thanks for the education.

I was able to connect directly to the database and change the encryption setting back.

6/18/2007 10:10:25 PM
Gravatar
Total Posts 112

Re: "set it back to not require encryption"

Hi Joe,

When you said "First set it back to not require encryption your old password shoud still be there and you should be able to login again" I set about to locate a way to "set it back" but I
haven't been able to locate how to "set it back to not require encryption" ; and, the old passwords are there.

Any help you can provide is very much appreciated,
Dale E. Moore

6/18/2007 10:31:42 PM
Gravatar
Total Posts 112

Re: Encrypting existing pwds

Hi Joe,

 

I found PasswordFormat used in mojoPortal.Web.Admin.ManageUsers.aspx.cs and that lead me to the msSQL database mp_sites.PasswordFormat = 0, 1, 2. Where 0=ClearText.

I'm back up and running again,
Dale E. Moore

You must sign in to post in the forums. This thread is closed to new posts.