Is there a way to manually locate user's passwords?

Product Support
1

I wan’t to know whether the admin has a way to view the forum user’s passwords & other info

2

Other info? Sure, all stored in the database. The passwords too, but hashed and salted - which boils down to a simple: “¡No way, señor!”

3

If any user forgot their password they can retrieve it on their own.

“I forgot my password” They can click that and go through the prompts.

No admin needs to know the passwords of their users.

4

s/retrieve/reset/

You really cannot “retrieve” it. But you can get the system to let you choose another one.

Very true. I would extend that to “No admin should know…”

5

So can the admin decrypt it?

6

Is there a way to view the database in a readable format?

7

No

Only in as much that hashes are readable

9

You would need to brute force the hashed password, its using PBKDF2 - Wikipedia with a rather high number of iterations so you would probably be stuck only being able to test out a handful of passwords a second.

On current computing hardware if the user picked a reasonable password you are probably looking at a few centuries of computer work.

10

Sure, install Discourse in dev mode or, not recommended, export your production Discourse’s PostgreSQL’s port and poke a hole in your firewall, then connect with pgAdmin and have a look around.

Oh and just to illustrate @sam’s point:

This is my password. Have fun trying to decrypt that. :slight_smile:

11

Don’t tempt him. We might be dealing with a Super Elite Class I Hacker.

elberet (Jens Maier) 12

11개의 좋아요
13

Awesome!
what a great challenge .. :slight_smile:

14

It’s a hash, it’s not encrypted. Encryption is reversible, hashing is not.

15

Depends, if you know that the cleartext is shorter than the hash blocklength, the hash is reversible. We just hope that noone ever finds an efficient (i.e. deterministic polynomial) reverse function. :wink:

Ok, “hope” is not exactly true. Cryptologists are fairly certain that for SHA2 no such function exists for current hardware.

17

Not exactly, minimum default password length today is 10 for regular users and 15 for staff. A weak 10 char password wouldn’t be terribly hard to break. See data at

We still need to create a password hash version and ramp up the hash difficulty a fair bit before 2020.

18

Not against ramping up hash difficulty by 2020 at all, but the most enormous risk will remain the “previously hacked list of passwords” that is constantly expanding, hopefully by 2020 we can go for 2fa by default and at least mitigate more of this long term

20

결국 그렇게 되지 않은 것 같습니다.

혹시 해당 discourse 인스턴스의 비밀번호 길이를 8자리로 변경하지 마세요. 불만을 가진 사용자들만 늘어날 뿐입니다. (직접 테스트해 보았는데, 제가 풀 수 있다면 누구나 풀 수 있습니다.)

21

실제로는 거의 완료되었습니다. staff에 대해 enforce_second_factor 설정이 모든 신규 인스턴스에서 기본적으로 활성화되어 있습니다.

기존 Discourse 인스턴스에서는 해당 설정을 staff로 전환할 수 있습니다.