I wan’t to know whether the admin has a way to view the forum user’s passwords & other info

You would need to brute force the hashed password, its using PBKDF2 - Wikipedia with a rather high number of iterations so you would probably be stuck only being able to test out a handful of passwords a second. On current computing hardware if the user picked a reasonable password you are probably looking at a few centuries of computer work.

Is there a way to view the database in a readable format?

[image] Ramith: So can the admin decrypt it? No [image] Ramith: Is there a way to view the database in a readable format? Only in as much that hashes are readable

Sure, install Discourse in dev mode or, not recommended, export your production Discourse’s PostgreSQL’s port and poke a hole in your firewall, then connect with pgAdmin and have a look around. Oh and just to illustrate @sam’s point: [image] This is my password. Have fun trying to decrypt that. :slight_smile:

Don’t tempt him. We might be dealing with a Super Elite Class I Hacker.

Awesome! what a great challenge .. :slight_smile:

Depends, if you know that the cleartext is shorter than the hash blocklength, the hash is reversible. We just hope that noone ever finds an efficient (i.e. deterministic polynomial) reverse function. :wink: Ok, “hope” is not exactly true. Cryptologists are fairly certain that for SHA2 no such function exists for current hardware.

[image] sam: On current computing hardware if the user picked a reasonable password you are probably looking at a few centuries of computer work. Not exactly, minimum default password length today is 10 for regular users and 15 for staff. A weak 10 char password wouldn’t be terribly hard to break. See data at [image] Hacker, Hack Thyself We’ve read so many sad stories about communities that were fatally compromised or destroyed due to security exploits. We took that lesson to heart when we founded the Discourse project; we endeavor to build open source software that is secure and... We still need to create a password hash version and ramp up the hash difficulty a fair bit before 2020.

Not against ramping up hash difficulty by 2020 at all, but the most enormous risk will remain the “previously hacked list of passwords” that is constantly expanding, hopefully by 2020 we can go for 2fa by default and at least mitigate more of this long term

Is there a way to manually locate user's passwords?

Product Support

Stephen (Stephen) April 29, 2015, 12:25pm 14

It’s a hash, it’s not encrypted. Encryption is reversible, hashing is not.

Topic		Replies	Views
What to do if your Discourse is compromised Self-Hosting reference	0	10541	February 24, 2016
Compromised Forum Admin Product Support	48	3113	June 5, 2023
Export password hashes in the PHC format Self-Hosting how-to	8	4859	January 7, 2021
Using Discourse as an account provider and PBKDF2 problems Development	9	769	December 7, 2023
Password hash algorithm Development	9	1946	May 14, 2021

Is there a way to manually locate user's passwords?

Related topics