I want to decode the encrypted value from database. I want to sent the actual password to user via mail when he gave forgot password.
The following is the code used for encoding the passowrd
BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String password = passwordEncoder.encode(user.getPassword());
How can do the decode?
BCrypt is a password hashing function, i.e. a one-way function.
You can't decrypt a BCrypt hash just like you can't go back from chicken mcnuggets to the original chicken.
You can only verify that two BCrypt hashes are the same, thus verifying that a supplied password matches the original one.
A typical solution to this is to send a single-use password reset link to the user, use secret questions or some other information confirming user identity to let them set a new password.
It is not advisable to send the actual password to the user. you can send an activation link rather in an email.
Related
This is a more conceptual question, but I'm trying to have some content be made available only to a specific user at a time. To do so, I thought about using a users password as an encryption key. However, the problem with that is that if I encrypt it using the plaintext password, I won't be able to encrypt anything as I'm obviously storing a hashed version in my database. If I encrypt it using the hashed password, then any database admin will be able to read the content of every user.
So basically, I need some kind of public/private key concept where I can encrypt it with a users public key but only they have access to their private key to decrypt it. Using actual RSA keys will be annoying in terms of usability though, as a user would have to write down their private key somewhere.
Is there a clever way for me to store data in a way that only a specific user can see it, somehow accessible through a password they set without being able to see their data as a server admin?
Example, assuming a website:
Random person chooses a receiver person, writes a message. That message should be stored in encrypted form in the database, using some form of public key.
Receiver person enters their password (Not a huge RSA key, optimally, but a standard passphrase), on the server side this password will be treated as some form of private key in order to deencrypt the data and send it back to the client.
So basically, I want to treat a simple passphrase as a private key, and generate a corresponding public key for it.
It looks like you want to use the same password for both authentication and for encryption.
Lets assume that only hashes of passwords are stored in a database (as it should be).
Issues:
"Remember me" function of web/mobile/desktop app will render encryption function impossible because user can log-in without password via token.
Admin can intercept login request to know user's password while it is transmitted in plain-text over https (simple infrastructure reconfiguration allows admin to sniff on traffic).
There is a way to secure transfers by using the same password in case:
you change your authentication procedure in a way that user sends to the server hashes only instead of plain-text password
and will save plain-text password at client side (for "remember me" scenario)
Then you could generate key pair during registration and save encrypted private key at server.
This way you will have access to your private key even after client side reinstallation (web/mobile/desktop).
So upon login you request your private key from server and use password which was used for authentication to decrypt your private key.
If you trust that admin(or whoever else) will not be able to meddle with software (especially in key exchange phase) then you have a way to implement the feature you need.
This will be hacker-proof solution until someone patches your code and every user in system gets wrong public keys of other users.
I'm searching for a specific way to encrypt my data.
I want to encrypt it with my password and decrypt it with that.
Later I want to gain other people access to chosen parts of my data with their passwords.
Is there any other way than to decrypt the data everytime I add a new "reader" and encrypt it all again with a "mix" of all passwords?
And than the big question is how to decrypt without knowing the passwords of everyone?
And than I thought of another problem. How to validate that the given/login password is correct?
I thought the following might work without saving the actual password or the encryption password:
Get a password ; "Thats an amazingly bad password"
Use the hash as encryption and decryption key ; hash(salt + "Thats an amazingly bad password")
Save the hashed hash as validation for the password ; hash(hash(salt + "Thats an amazingly bad password"))
What do you think about it?
Thanks for help everyone
Encrypt the data once with a secure key such as random bytes.
For each user encrypt the above key using the user's password (properly extended), save that in a file or DB under the userID and a salted/hashed password for authentication.
To access lookup the user's entry verify the supplied password with the salted/hashed password, decrypt the data key with the user's password.
Decrypt the data with the data key and return to the user.
Side advantage: A user's password can be changed without changing the actual key the data is encrypted with.
For the second part:
Do not hash(hash(salt + "Thats an amazingly bad password")), use a password extension method such as PBKDF2 on the user supplied password for the encryption key. Such methods take a salt and a password and iterate many times to make the operation slow, somewhere around 100ms seems to be a good target.
Hashing a hash does not accomplish anything other than adding a trivial amount of time to the operation.
I need to send a mail to a umbraco user(member) with a password remind.
I work with umbraco.cms.businesslogic.member.Member class:
Member member = Member.GetMemberFromLoginName(userName);
string password = member.Password;
But when I look into this password apparently is a "coded"(crypted) password, not the "clear" one..
Is there a way to obtain a "clear" password ?
The passwords are hashed (and quite possibly salted) during account creation. The website doesn't know what the plaintext password is - it only can compare the hash (one-way cryptographic function, in theory irreversible) of what user inputed into password box with the stored hash.
The "forgot password" should verify owner of the account and send an e-mail with password reset link. Sending plaintext passwords emails is a huge security violation, as users often reuse their passwords on multiple sites, and gaining access to users email would expose password that can be tried on hundreds upon hundreds of different websites/systems.
Hopefully not.
It is very bad practice to store passwords in a way that allows for them to be recovered.
What you can do instead of "password reminder" is "password reset": Send them an email with a link that allows them to reset their password. Protected by some unique number that expires after a few hours and can only be used once.
I browse but didn't got proper solution.i am working on asp.net membership all i want to do is to retrieve user password when user apply for forgot password for condition 1. i want password to be in encrypted format in database and 2. retrieve password in decrypted format.is it possible.
Normally, encrypted passwords would be stored using a one way hash. This means
that the password cannot be decrypted once it is stored. Many authentication systems
work by taking the password ( of the user trying to authenticate ), encrypting
it using the same one way hash function as was used to store the password in the
database, and then doing a string comparison in order to determine if the
resulting encrypted password matches the one that exists in the database.
How are you determining if the user requesting the password is actually
the owner of the account ? Perhaps you can clarify your question with details
of the environment so that we may offer alternative solutions.
Use PasswordRecoveryControl
But anyhow it's not advisable to send password in plain text format.
I store the customers passwords in DB using encryption.
When the customer edits his personal data (including the password) the passwords are shown as *****
How can i understand that the use change his password so write to DB without encrypted again and again.
I mean that the value in password field is the encrypted value. If dont change the password must update with the same value (or not update at all)
If user change password to 1234 I must encrypt the 1234 and write to DB the encrypted value
Thanks
Don't send the md5 hashed string from the DB back. Set up three fields:
Old password
New password
New password again
Then check if the first field after md5 hashing is equal to the stored one in the DB. If it is, hash the second field and store it. (Only if the second and third is equal)
You should require entering both old and new password when user wants to change it.
That way, you can encode the old password, check if the encoded value is the same as in the database. If it is the same, then the you should update the password in db with encoded new password. If it is not the same (or old password is empty) you do not update.
This helps you to distinguish between password change and settings-only change. You also gain a some level of security, as if someone have captured the session of your user, he cannot change his password without also capturing is original password.
A few points:
MD5 is a hashing algorithm, you will never be able to reverse the hash and that's the point.
Don't use MD5 as it has been cracked, use an SHA2+ Hash Algorithm (SHA256 for example)
Simply confirm the password with the "old password" by hashing the old password against the one in the database.
Another option is resetting the password, which will email their confirmed (hopefully) contact email with the new password.
If they're logged into the system already, you should not need to "confirm" the old password again.
Never send the hashed password back from the database, it is kind of defeating the purpose of what you are trying to accomplish.