Password Security question

Discussion in 'Pre-Sales Questions' started by mywaza, Jul 5, 2004.

  1. mywaza

    mywaza Guest

    The trial version stores the user's password in clear text in the mySQL database. This is clearly unnecessary and a serious security violation.

    Is this problem present in the production release or only the trial version ?
  2. pilot

    pilot New Member

    Joined:
    May 24, 2003
    Messages:
    178
    There must be a serious problem with the hosting if anyone can see the mysql database user and password fields surely?

    The database is protected by a password and username and should be nigh on impossible to hack into if Apache is set up properly.

    If someone can get that far, then the whole website is in grave trouble.

    Never the less, Alex has said in the past that encyption is on the way for users. The Admin password is encrypted

    Amember User
  3. mywaza

    mywaza Guest

    Basic Admin Security

    You should not have to be a production secure site admin to understand that even the admin and DBA must not have access to user's passwords. Even if you have the DBA site password, this must not, by definition, give you access to any other user passwords. This is not Berkeley's Unix anymore.

    Trusted admin may be able to reset the password, but even this should be audited.

    This is a completely separate issue from the DBA password and site security. Specifically, if the site is hacked and the database opened, at least user passwords are not compromised.
  4. alex

    alex Administrator Staff Member

    Joined:
    Jan 24, 2004
    Messages:
    6,020
    It is possible to hide passwords in aMember CP, we will possible implement it in future version.

    However, aMember need passwords in clear-text, because it supports integration plugins and manages third-party users databases. We could use two-way encryption, but as you understand it is not very secure.
  5. maranate

    maranate New Member

    Joined:
    Jul 22, 2006
    Messages:
    2
    I just (finally) downloaded the trial version, and I see that I can still see the user's passwords.

    I don't know that much about anything, but I guess I don't understand why Joomla can pass passwords to other things (like SMF) without storing the password in clear text, and aMember can not?

    This is seriously one thing that would keep me from purchasing aMember because so many use the same passwords over and over.
  6. alex

    alex Administrator Staff Member

    Joined:
    Jan 24, 2004
    Messages:
    6,020
    Passwords will be hidden in 3.0.4 (on the next week). But in database passwords still be anyway plain-text.

    Regarding Joomla - it is only possible if SMF uses the same format of passwords as Joomla (it is really simple MD5(password)). If all scripts use MD5, we of course would do the same in aMember, and we would be HAPPY to do that ! Unfortunately, it is not so.

    I understand and agree with your concerns, we are seeking for a best way to resolve this. In your situation, generating a password during signup would be a solution.

Share This Page