Re: Decrypt Password
| From: | Joakim Andersson | Date: | Wed, 27 Nov 2002 10:14:41 +0000 |
| Subject: | Re: Decrypt Password | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-126257@lists.php.net to get a copy of this message | ||
Stephen wrote:
That's what I'm going to do but how can I pull it from the database to decrypt it, then send it?You can't. Well that depends what method you used to create the passwords, but most likely you used a one-way encryption. How to solve the problem then? 1. User klicks link 'Forgot my password' 2. Generate a one-time password for this user. Do not change the users ordinary password yet. 3. Send mail to user with the one-time pw. This must be a verified mailaddress. 4. Let the user enter his login/mailaddress and the one-time pw to login. 5. Let the user enter a new pw. Then update the dB. That's one way to do it with reasonable security. Regards Joakim