How to return the current password and not create a new one

[Trond]

Let's say you are designing a system where everyone from one company shall have the same password, and then John Doe - for some reason - has forgotten the password and requests it from the website.

Then you must be able to return the current password and not create a new one - and then tell everyone that the password has been changed.

So how would you go about and do this?

[Dormilich]

let John Doe ask someone from the company for the password.

[kovik]

Though this is a double-necro'd thread, I'll answer your question...

If you want to be able to retrieve a password for a user, then don't use one-way encryption in the first place.


Problem solved.

[david david]

question

hey but how can it be one way?! if a = b*5 then b = a/5 so there is no equation that cant be solved other way... well if u can get hash string from one pw than it should be easy to solve it backwards... tell me how does facebook checks ur pw if it cant be other way equation?

[Atli]

hey but how can it be one way?! if a = b*5 then b = a/5 so there is no equation that cant be solved other way... well if u can get hash string from one pw than it should be easy to solve it backwards... tell me how does facebook checks ur pw if it cant be other way equation?

The hashing algorithms are designed to be non-reversible. These are not simple algebraic formulas that can be shuffled around to "solve for x". - That is not to say it is impossible to reverse them, but it would take extremely complex math and probably a super-computer or two to process it. - I won't pretend to be an expert on the subject, but the hashing algorithms themselves and common implementations are publicly available so you can see for yourself. (See MD5 or SHA1 on Wikipedia.)

To match a hashed password against a password given by a user (e.g. on a standard login page) you hash the input password as well and then compare the two hashes. - If you hash the same string twice, it will return the same hash twice. It's not random.

[Oralloy]

Folks,

MD5 is a hashcode, similar to a checksum.

You can compute the MD5 of an arbitrary length bit string by padding out with zeroes to its basic unit length (which I believe is 512 bits or bytes, but I'm not completely certain).

As near as possible, the algorithm attempts to preclude any reversible transform between output bits changed and any on-bit input change. Which is to say it is, by design, irreversible.

So, even though your passwords are only a few characters long, they may well hash into the same MD5 values.

However, if you really, really need to crack a password, you can reproduce the pasword computation algorithm and feed it guesses until the "right" answer pops out. Generally the guesses start out with a dictionary search, and then get more complex from there. By the time you include both cases, digits, special characters, and varying lengths, you rapidly run into huge numbers of possibilities.

There is no magic here - you are supposed to be unable to invert the hash code.

That said, this thread is inappropriate for the Bytes forum. Please don't ask this sort of question again.