admin can view users password in profile

[[Unknown]]

Look, why does it matter?

The simple thing is, many people use one password (or just a few passwords) for all/many of their online accounts... perhaps even ebay, whatever, etc.... and it is a GROSS invasion of privacy to allow ANYONE whether they be a guest, an administrator, a webhost, or even a KGB operative access to their password.  Let them have their passwords.  If you are too inadept to encrypt what they give you the same way and check against that, don't bother programming in PHP.

I'm sorry if I get a little out of line, but I find this topic full of petty little administrators looking to spit on their users.

I have had users from my board (which has about 1600 users) ask me for their passwords, and I just say "your password is now 'reset'." - and it works for them and me.
Please, don't push the issue - there is absolutely no reason for you to have access to their passwords, and that is that.

-[Unknown]

[edit: lock please?]

[DeadSeraphim]

Let them have their passwords.  If you are too inadept to encrypt what they give you the same way and check against that, don't bother programming in PHP.

That's one hell of a way to enourage people to learn PHP and participate in this community.  Good job.  

I'm sorry if I get a little out of line, but I find this topic full of petty little administrators looking to spit on their users.

If you were sorry, you wouldn't have done it.  Or at least gone back and edited your post with something more than a request to lock the thread.

You find what you WANT to find in this thread.  I'm sure some people would happily abuse such a system.  I for one (like anyone who really thinks about it) use multiple passwords specifically because of things like that.

However, md5 is NOT secure.  It CAN be decrypted.  The password can be re-created from the hash code, if only from the brute-force cycle-until-it-matches method.  If an administrator is bound and determined to get their users passwords, a little time searching and they'll have them.  It IS easier to write a brute-force script then change an exsisting program over to match YaBB's encryption, by the way.

So what benefit is it to use the hash code instead of just storing the passwords?  It makes it INCONVENIENT for unscrupulous administrators to get at them.  It doesn't stop them.  In the interum, those of us who struggle with PHP often get discouraged by the added complexity it adds to already tedious journeys in to somebody else's code.

Now, with all that being said, we have a difference in oppinion.  Maybe now you have enough background on my point of view that you won't continue throwing around "inadept" and "petty."

[[Unknown]]

To put password handling in your script (with or without SSI.php)

$passwrd = crypt($passwrd, substr($passwrd, 0, 2));
where passwrd is the passwrd they typed in, and then compare it aginst what's in the database.

The cookie has additional measures in it.  Normally it is encrypted (after the standard encrypting above) like so:
$passwrd = crypt($passwrd, 'ys');

Done.  Was that so hard?  I simply think that you are in over your head if you can't do that.

And yes, I AM sorry IF I offended you... which it seems I did.
I'm aware that in Descarte's philosophy, everything is in the eye of the beholder... but I happen to believe more in Plato.
I've seen people like this, I even have a friend like this.  They like to have power.... and being able to see someone's password makes them feel like they have it.  Some abuse this power.... and it's not right.

And, so you know, I write things like I would say them - if I say something I realize might offend people, I'm not going to dilute it.

To my recollection, (which I will give you could be wrong) decryption schemes for MD5 sometimes work, but not always.  Like with any good encryption, there are a few possible answers.

Here's an example of decrypts:
Dhb#d5
dsHTs1
mypass

Hmmm which one is it? [sarcasm]Why, I don't know![/sarcasm]

However, this is why people are told to use good passwords... ie. my passwords usually look like this: "dsTw,b4".

So what benefit is it to use the hash code instead of just storing the passwords?  It makes it INCONVENIENT for unscrupulous administrators to get at them.  It doesn't stop them.  In the interum, those of us who struggle with PHP often get discouraged by the added complexity it adds to already tedious journeys in to somebody else's code.

The benefit is that you detour the power hungry admins who just like "being able to do it."  Why should they need to get to them?  Besides, with the help of SSI.php or the snippets I posted up there... what comnplex, difficult journey lies in store for these "unscruplulous administrators"?

And, I must say that YaBBSE takes GREAT PAINS to make it's code highly readable and easily understandable - which it is.  The journey does not need to be littered with the hopes and wants to do things that simply have no reason to be done, like getting at a user's password.

I never called you petty.  In fact, I meant that more to the first few posters.  However, you are inadept.  There are things I'm inadept at - for example, I'm inadept at social situations because my father never let me leave the house except for school until I was 10 years old.  (although I did manage to get out once to a friend's house...)  We all have our weaknesses, and there's no reason to deny yours.  Temporary as it might be.

I would further like to say that FYI, Windows 2000 Server/Windows .NET Server passwords can ALSO be cracked through brute force methods.  MY FRIGGIN' WORD - the WPA can be hacked with it as well.  Does that mean that administrators around the world will stop using the Windows Server Family?  Will Microsoft release a new version of Windows XP, now without the WPA?

Please, there is no reason, I say yet again, for you to need to see your user's passwords.  Whether for integration, resetting, or power-hunger.... there is no good reason.

However, just because my philosophy is platonic does not mean I'm always right - it just means that there is a 'right.'

-[Unknown]

[edit:  As of this writing, I have not slept for 24 hours.... so I might not make complete sense.]

[PioneeR]

Get some sleep Uknown  

When admins can change a members password.. then surely this is enough. Being able to see them isnt needed. Not unless you want to log on as that user  

When my members forget their passwords (they dont seem to use the forget password option).. they email me. I reset the password. Inform them of the new password and ask them to change it when they next log on  

[tdodnz]

OK I EDITED MY POST
I will not do this mod no matter what i know how and can without using brute-force but I fully object to the idea of being able to view the users password as most users have the same password for all their logins, I for one have 5 just incase of crap like this.
NO FULL INVASION OF PRIVACY AND SECURITY ON THE INTERNET AS A WHOLE NOT JUST THE FORUM IT IS TO EASY TO ABUSE.

[riz]

ive actually achieved this by accident.

i run the webserver with the board on it, i also run the mail server that sends the passwords to users, as the mail server deals only with personal adreses on my domain i have multiple accounts, to make backing up easier i set the mail server to send a copy of all sent and received emails to a folder in the main webmaster account, as a result of this i get a copy of every email sent out to users.
i get a crapload of errors when i click on the "forgot password" button, i am gonna keep this accidental feature.

i imagine other accounts can be set to keep a draft of all sent emails therefore, non encrypted passwords....