0

i'm facing an issue, some of you may help me find a clue ?

i have password, that come from an external source. allready md5 applied on it

$external_password_md5;

what i'm trye to achieve is to compare that external password, with magento stored one

$magento_password = Mage::getModel("customer/customer")
                        ->setWebsiteId(Mage::app()
                        ->getWebsite()
                        ->getId())
                        ->loadByEmail($email)
                        ->getPasswordHash();

for as same email, external_password_md5 and magento password are relative the same inputed string (thay match in plain text), but i can't managed to get the two compared.

The fact is, that magento uses for password crypt this kind of code

 $magento_password = md5($salt.$password).':'.$salt;

even if I have the $salt, my external_password is allready md5, so applying magento way on allready md5 password won't give anything.

Has anyone an idea how to achieve a comparaison that works ?

"pseudo code"

if ($external_password_md5 == $magento_password)
2

That's impossible by design unless you have the password in plain text (for example when a user tries to login)

Hash functions are irreversible. For md5 there are so called rainbow tables, i.e. lists of hashes for words and common passwords, so in some cases you could find out the password. But for strong passwords it's impossible.

Also note that the fact that you can create collisions for md5 hashes does not help in your case because if two strings have the same md5 hash, they will not have the same md5 hash if a salt is added.

| improve this answer | |
  • Thanks for taking time to explain that. I was hopping there was a way, but there's no. – ffab Oct 6 '16 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.