I wan’t to know whether the admin has a way to view the forum user’s passwords & other info

You would need to brute force the hashed password, its using PBKDF2 - Wikipedia with a rather high number of iterations so you would probably be stuck only being able to test out a handful of passwords a second. On current computing hardware if the user picked a reasonable password you are probably looking at a few centuries of computer work.

Other info? Sure, all stored in the database. The passwords too, but hashed and salted - which boils down to a simple: “¡No way, señor!”

If any user forgot their password they can retrieve it on their own. [image] “I forgot my password” They can click that and go through the prompts. No admin needs to know the passwords of their users.

[image] purldator: If any user forgot their password they can retrieve it on their own. s/retrieve/reset/ You really cannot “retrieve” it. But you can get the system to let you choose another one. [image] purldator: No admin needs to know the passwords of their users. Very true. I would extend that to “No admin should know…”

Is there a way to view the database in a readable format?

[image] Ramith: So can the admin decrypt it? No [image] Ramith: Is there a way to view the database in a readable format? Only in as much that hashes are readable

Sure, install Discourse in dev mode or, not recommended, export your production Discourse’s PostgreSQL’s port and poke a hole in your firewall, then connect with pgAdmin and have a look around. Oh and just to illustrate @sam’s point: [image] This is my password. Have fun trying to decrypt that. :slight_smile:

Don’t tempt him. We might be dealing with a Super Elite Class I Hacker.

Awesome! what a great challenge .. :slight_smile:

It’s a hash, it’s not encrypted. Encryption is reversible, hashing is not.

Is there a way to manually locate user's passwords?

Product Support

Ramith (Ramith Hettiarachchi) February 22, 2015, 3:42am 5

So can the admin decrypt it?

Topic		Replies	Views
What to do if your Discourse is compromised Self-Hosting reference	0	10541	February 24, 2016
Compromised Forum Admin Product Support	48	3113	June 5, 2023
Export password hashes in the PHC format Self-Hosting how-to	8	4859	January 7, 2021
Using Discourse as an account provider and PBKDF2 problems Development	9	769	December 7, 2023
Password hash algorithm Development	9	1946	May 14, 2021

Is there a way to manually locate user's passwords?

Related topics