bugzy Posted August 22, 2012 Share Posted August 22, 2012 I have my user's password saved in the database using sha1 so base on my research, it's hard to decode it and there's no way I can show to my users the actual password they have saved once they use my feature "forget password" which will be sent via e-mail. I wonder if is it safe to put the user's ID and sha1 password in the url? The link will be sent via e-mail as what I have said and once they click it, it will be verified via $_GET and then post a new form which will give them an option to put a new password.. I wonder if this will work or there's a security issue on this? Or do you guys have any approach on this? Thanks Quote Link to comment https://forums.phpfreaks.com/topic/267407-users-password-retrieval/ Share on other sites More sharing options...
trq Posted August 22, 2012 Share Posted August 22, 2012 Reset the users password to something you know and send them that. Quote Link to comment https://forums.phpfreaks.com/topic/267407-users-password-retrieval/#findComment-1371357 Share on other sites More sharing options...
bugzy Posted August 22, 2012 Author Share Posted August 22, 2012 Reset the users password to something you know and send them that. thorpe that was really a great and simple solution though I wonder where will I get that password? as much as possible I want everything to be automated in php. Will I put a default password value for resetting a password or there will be a list of password? Because if there was a list or a default value? Do you think it is very vulnerable for some kind of sabotaging my website? Quote Link to comment https://forums.phpfreaks.com/topic/267407-users-password-retrieval/#findComment-1371360 Share on other sites More sharing options...
floridaflatlander Posted August 22, 2012 Share Posted August 22, 2012 Once the pw is hashed you can say it's impossible for joe average, AKA people like you and me, to get the pawword out. I know sites that can email you your password when you foregt it, not email you a new password. I would guess they have another table with the password in it, I would also guess they don't put it in the members table. Quote Link to comment https://forums.phpfreaks.com/topic/267407-users-password-retrieval/#findComment-1371363 Share on other sites More sharing options...
floridaflatlander Posted August 22, 2012 Share Posted August 22, 2012 Reset the users password to something you know and send them that. thorpe that was really a great and simple solution though I wonder where will I get that password? Sorry, didn't read your 2nd post well To make a new pw I use ... $pw = substr( md5(uniqid(rand(), true)), 3, 10); Quote Link to comment https://forums.phpfreaks.com/topic/267407-users-password-retrieval/#findComment-1371368 Share on other sites More sharing options...
bugzy Posted August 22, 2012 Author Share Posted August 22, 2012 Thanks to thorpe for giving me idea and thanks to floridaflatlander for giving an idea on how to generate a new password.. Thanks again guys! Quote Link to comment https://forums.phpfreaks.com/topic/267407-users-password-retrieval/#findComment-1371392 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.