0

I need a solution to send the OLD password of a customer who click and enter his email address in Forgot your password page. The default email template send just a link inviting the customer to reset his password at the site's page.

Improve this question
2
  • 3
    The passwords are hashed. There is no (usable) way of de-hashing them.
    – Marius ♦
    Nov 3, 2013 at 8:35
  • Magento CE stores the password using a one way MD5 hash. It is not reversible encryption. Any website that can send the user their password is usually storing it as plaintext and is a hacker magnet. Asking for this is indicating your website has no security.
    – Fiasco Labs
    Nov 4, 2013 at 0:52

3 Answers 3

Reset to default
4

The current password of a given user cannot be retrieved from the database. Community Edition uses a salted md5 hash and Enterprise a salted sha256 hash. I.e. It's not encrypted, it's an irreversible hash which the users input is hashed and then matched against when logging in to verify validity.

Improve this answer
2

This can be done by resetting the password through the backend Customers > Manage customers > [choose customer] > Account information > Password management.

enter image description here

Improve this answer
4
  • Thanks, but it is not what I am looking for. I need a solution to send the OLD password of a customer who click and enter his email address in Forgot your password page. The default email template send just a link inviting the customer to reset his password at the site's page.
    – capola
    Nov 3, 2013 at 8:15
  • 3
    Since the old password is hashed with md5 before storing in the database this will not be possible.
    – Sander Mangel ♦
    Nov 3, 2013 at 8:42
  • I guess if I choose in Password Options>Forgot Email Template a Remind Password template, a NEW auto generated password will be send?
    – capola
    Nov 3, 2013 at 8:51
  • 1
    the template is not of influence of the password that is sent. It's just the design for the email. As there is no way to decrypt the passwords from the DB recovering a password will alway be a newly chosen/generated password
    – Sander Mangel ♦
    Nov 3, 2013 at 9:12
1

It is not possible to send the old password.

Recovering the old password might be userfriendly for your customers, but from a security point of view it's the best if the password can't be calculated back again and a new one will be generated. Just imagine someone retrieves access to your database - he/she could decrypt all passwords of your customers (which, might be used by them on other websites too...).

Improve this answer
1
  • Or worse, stored as plaintext, no need for any effort to get the keys to the customer's kingdom, given the way they reuse the some old thing everywhere.
    – Fiasco Labs
    Nov 4, 2013 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.