0

I need a solution to send the OLD password of a customer who click and enter his email address in Forgot your password page. The default email template send just a link inviting the customer to reset his password at the site's page.

  • 3
    The passwords are hashed. There is no (usable) way of de-hashing them. – Marius Nov 3 '13 at 8:35
  • Magento CE stores the password using a one way MD5 hash. It is not reversible encryption. Any website that can send the user their password is usually storing it as plaintext and is a hacker magnet. Asking for this is indicating your website has no security. – Fiasco Labs Nov 4 '13 at 0:52
4

The current password of a given user cannot be retrieved from the database. Community Edition uses a salted md5 hash and Enterprise a salted sha256 hash. I.e. It's not encrypted, it's an irreversible hash which the users input is hashed and then matched against when logging in to verify validity.

2

This can be done by resetting the password through the backend Customers > Manage customers > [choose customer] > Account information > Password management.

enter image description here

  • Thanks, but it is not what I am looking for. I need a solution to send the OLD password of a customer who click and enter his email address in Forgot your password page. The default email template send just a link inviting the customer to reset his password at the site's page. – capola Nov 3 '13 at 8:15
  • 3
    Since the old password is hashed with md5 before storing in the database this will not be possible. – Sander Mangel Nov 3 '13 at 8:42
  • I guess if I choose in Password Options>Forgot Email Template a Remind Password template, a NEW auto generated password will be send? – capola Nov 3 '13 at 8:51
  • 1
    the template is not of influence of the password that is sent. It's just the design for the email. As there is no way to decrypt the passwords from the DB recovering a password will alway be a newly chosen/generated password – Sander Mangel Nov 3 '13 at 9:12
1

It is not possible to send the old password.

Recovering the old password might be userfriendly for your customers, but from a security point of view it's the best if the password can't be calculated back again and a new one will be generated. Just imagine someone retrieves access to your database - he/she could decrypt all passwords of your customers (which, might be used by them on other websites too...).

  • Or worse, stored as plaintext, no need for any effort to get the keys to the customer's kingdom, given the way they reuse the some old thing everywhere. – Fiasco Labs Nov 4 '13 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.