perl password encoding

[gchen]

Hi, Need some admin help here...

i have a perl script to take username/password for instant sign-up and they were written to an ascii file. All were working fine except when the user lost his/her password, i can not recall it and have to ask them to re-sign up again. i know there is a way to decode the perl encripted password. i need that to comlete the "lost password" service call.

Can anybody help?

Thanks!

Gary

 

[chazoid]

Assuming you have access to the perl script, I'd say the first step is to look at it to determine what method it's using to encrypt the passwords. It could be as simple as ROT13

 

[gchen]

I checked the script and believe it is using below line --

$pass=crypt($user_data{password},7);

Any clue?

Thanks!

 

[MikeLacey]

Hi Gary,

You can't get the passwd back from the crypt data.

Sites that do the "lost password" thing don't use crypt() to encode the password - you'll have to do something else I'm afraid, some encoding algorithm that allows you to get back to the clear text passwd from the encoded version.



Mike

"Deliver me from the bane of civilised life; teddy bear envy."

Want to get great answers to your Tek-Tips questions? Have a look at faq219-2884

 

[gchen]

Hi Mike,

Thank you! I managed to save the raw pw to a secured directory for later reference. Guess this is the most effective way to do it.

Gary

 

[MikeLacey]

It's a bit fraught I know, saving unencrypted passwords. And encrypting them securely is hard as well - if someone has access to your source code they can see how you've done it.

I ended up using perl2exe so that the encryption keywords were hidden; this let me store passwords that were encrypted in a way that let me get back to the original password - and then storing source code on another server. *Still* not very secure as the developers could work out how to get at passwords but better than before.

Mike

"Deliver me from the bane of civilised life; teddy bear envy."

Want to get great answers to your Tek-Tips questions? Have a look at faq219-2884