Printable View
Olá eu queria saber qual é o tipo de sistema que meu Registro usa exemplo MD5 e outros para que eu possa converter a senha de qualquer jogador do meu jogo!
E no registro tem estas linhas:
// $Salt = $Login.$Pass;
// $Salt = md5($Salt);
// $Salt = "0x".$Salt;
$Salt = base64_encode(md5($Login.$Pass, true));
What is $Login?
If you have the salt, then you can decrypt it easy. Why are you doing md5(md5(blah));? that wont work unless your trying to output it. I am quite confused, post the full script.
PS ever heard of phishing? Protect your users privacy
engls pls :huh:Quote:
Originally Posted by kombinho
[EN]
Use force password plugin...
Is "impossible" to "decode" md5.
You can hash a new passwd base_64.md5 and put it in database
[PT]
Usa o plugin de forçar senhas...
Não é possível reverter uma hash md5, além de ser crime...
Faça o plugin gerar uma nova senha encriptada e coloque nas strings passwd e passwd2 da database...
MD5 is decryptable, Its the salt I am having problems with.Quote:
Originally Posted by brennerdvaz
I wish I could know the passwords of registered users without having to affect them in some way :/
Well then remove the salt, use plain sha1 or md5. Then you can just run your users passwords through a dectypter.Quote:
Originally Posted by kombinho
except for the small fact that with the login and password combined your string reaches such a length that no "decrypter" (really just a rainbow tables database) will be able to do anything.
Only asshats store users passwords unencrypted.
I wonder if somebody told them what you are doing? asshat.
Dude, MD5 or SHA are hashing functions. No Encryption. You cannot "decrypt" them, you can only brute force them, and that's pretty pointless if it's salted.
Is there any way I can change the system without affecting those that are already registered?
^Quote:
Originally Posted by rbb138
this
No and you should not do it.Quote:
Originally Posted by kombinho
If you want to log your users make a system to change the password for a short time.
Why do you want to know your users passwords, so you can see if any of them were dumb enough to use the same combination on official PWi (so you can steal their shit) ???
There is NO good reason to store passwords unencrypted!
Furthermore (like Souris already said): if for any reason you need to log someones character or account, there are ways to do it without invading a users privacy (yes, passwords are PRIVATE in nature). Step one, copy and SAVE the data in the password field of the DB for the specified user. Step two, use a force password change to change it to something you can use temporarily. Step three, do whatever it is that you need to do. Step four, take the info you copied and SAVED from step one, and restore their original password in the DB :wink:
pretty easy actually, and then you're not violating anyone's privacy
:closed_2: