After I establish and user and set their password, is there a way to have users reset their passwords on login? I'd like the password I set for them to be temporary.
Thanks!
When you sign up your user, make something that says that their password is temporary (such as a field in the database that's an int with either 0 or 1). When they log in, it should check the field for if the password is temporary, and if it is, then ask them for their real password and use the UPDATE statement to update their password. If it isn't, continue normally.
Related
I'm using the FOSUserBundle on a Symfony project, and I would like to know if, when a user changes his password, I can have access to his former password. The one he's supposed to enter in the "current password" field.
I have a system of encryption on my project, and it's partially based on the user's password, that's why I need it, to update the user's encryption settings.
I created a listener when the user changes his password but I don't know how to get his former password. Or current password, whatever.
Thank you for your help !
Short answer: NO. If user won't give you his current password by typing it in form it's impossible to guess his password.
Only option to have access to current user's password is when password is stored in database in plain text which is rather not the case.
The way passwords are stored in db usually is by using hashing function which are designed to be impossible to invert - you are able to hash your password but you can't unhash it.
In theory you could try to use Rainbow tables but it's not something you could use in regular way on every passwprd change because it's very CPU heavy.
encrypt the new password.
compare the hash of the new password and the hash password in the database.
I want to get an user's password value from users Collection.I can get all Documents except the password.What would cause and
i need check old password When users want to change their password with new.How can I do?
User passwords are safely encoded with bcrypt according to industry best practices. That means you cannot "unencode" them.
If you want users to change their password, use Accounts.changePassword.
If your users have forgotten their passwords, you can use Accounts.resetPassword.
I am using the ChangePassword web control in order to change the user password. my provider is using hashed password, and I am want to keep using it.
just wanted to know if there is a way to compare the current password the user entered with the old password in the DB.
You can use Membership.ValidateUser method, that returns true or false, depending on whether the entered password - in your case the new password - is the same as the old password.
http://msdn.microsoft.com/en-us/library/system.web.security.membership.validateuser.aspx
hash the current password and compare it.. thats how it is ususally done
A customer of ours complained about login password recovery using plain text password. The only workaround I know is auto-login with encripted username and passord in the query string.
What other options exist to increase the password recovery security?
Thanks.
You can send them a URL that lets them reset the password themselves.
You could create a database table that stores, at the very minimum, a user id and a hash value.
Send the user a link that includes the hash, and on the receiving page look up the associated information and allow the user to reset the password to the account. Which I'm hoping you store in the database as a hash value. Plain text passwords should never be stored or sent out.
Just be sure that the link either expires or is deactivated once the password is changed. Otherwise someone could visit that link whenever they want and change the password.
Along the same lines as Brandon's excellent answer, here is what we do:
Do not store passwords in plain text, or even a decryptable value. Always store passwords using a 1-way hashing algorithm. This means only the user can ever know what the plain-text password is.
When a user forgets their password, present them with a form where they enter their email address, and click submit.
When they submit their email address, create a table row with 2 major pieces: The first is a password reset token (we use a Guid for this). The token should be timestamped, so that you know when it was created, and when it expires (ours expire within 2 hours of submission). The second piece is a secret code that the user will have to enter in order to reset their password.
Send an email to the user, with a link to a page that will accept the token and secret code. When they click the link (or visit the page and enter the code manually), you can then present them with a page that lets them change their password without knowing its previous value.
Using a time-constrained token is a good idea, because if the user's email account is later compromised, the criminals can't use the email to reset the password -- assuming of course that the email account is not compromised within 2 hours of the password reset request.
I wouldn't send out the actual password of the account in plain text to the user's email address. The reason for this is because if someone hacked the users email address now they have their actual password. Most likely this password will be used for other systems as well.
The alternative is to send an encrypted querystring that links to that user and allow them to change their password based on some sort of security question or demographics you have specific to that user.
Facebook uses a matching of friends images to names. If you have their DOB and address you could use that (not that secure). Or you could set up specific security question and answers which would be better.
I store the customers passwords in DB using encryption.
When the customer edits his personal data (including the password) the passwords are shown as *****
How can i understand that the use change his password so write to DB without encrypted again and again.
I mean that the value in password field is the encrypted value. If dont change the password must update with the same value (or not update at all)
If user change password to 1234 I must encrypt the 1234 and write to DB the encrypted value
Thanks
Don't send the md5 hashed string from the DB back. Set up three fields:
Old password
New password
New password again
Then check if the first field after md5 hashing is equal to the stored one in the DB. If it is, hash the second field and store it. (Only if the second and third is equal)
You should require entering both old and new password when user wants to change it.
That way, you can encode the old password, check if the encoded value is the same as in the database. If it is the same, then the you should update the password in db with encoded new password. If it is not the same (or old password is empty) you do not update.
This helps you to distinguish between password change and settings-only change. You also gain a some level of security, as if someone have captured the session of your user, he cannot change his password without also capturing is original password.
A few points:
MD5 is a hashing algorithm, you will never be able to reverse the hash and that's the point.
Don't use MD5 as it has been cracked, use an SHA2+ Hash Algorithm (SHA256 for example)
Simply confirm the password with the "old password" by hashing the old password against the one in the database.
Another option is resetting the password, which will email their confirmed (hopefully) contact email with the new password.
If they're logged into the system already, you should not need to "confirm" the old password again.
Never send the hashed password back from the database, it is kind of defeating the purpose of what you are trying to accomplish.