Wiki password recovery

[Pietry]

Unfortunately when http://www.adcportal.com became CNAME on adcportal.sf.net , my firefox lost the password to the wiki
The problem is there is no way to recover it.
I guess the password must be written in the database via some UPDATE statement.
Perhaps Catalin or Crise might help.
( Also a little script for recovering passwords might be useful for the future ... )
Thanks.

[Toast]

Since this can be a sensitive discussion i moved it

http://www.mediawiki.org/wiki/Manual:Ru ... eforge.net
http://www.mediawiki.org/wiki/Manual:Re ... _passwords
http://www.mediawiki.org/wiki/Manual:$wgPasswordSalt
http://www.mediawiki.org/wiki/Manual:$w ... ptThrottle

There are plenty of tools just not sure which one of them are good so please everyone help out the more we do for the wiki the more this site grows since the wiki is running hot

[Crise]

As I stated there is absolutely no way to send emails from where the wiki or the forums are, so any "standard" methods of password recovery won't work... if user with full privs in the wiki can change an individual account passwords manually then that could be the best solution (I have not checked whether or not this is possible).

Also another possibility is that, if you have actually saved the password using the firefox's remember password -feature then it is actually possible for you to view the password(s) in firefox options....

Also for future reference, it is highly unlikely that any recent web application uses plain passwords in db anymore so, manual recovery using the database will in the best case (from security point of view) be almost impossible.

Many web solutions that deal with passwords can f.ex. store a salt and a password hash pair, where the password hash could be for example: md5(md5($salt) . md5($pw)); (note that naturally each account would have their own $salt generated upon registering). Then with that the script can compare a hash generated from user input with the hash stored in db when verifying user logins. (For the curious type, this example is how IPB does it).

Edit: from the looks of it mediawiki seems to be doing something similar to above (probably not exactly the same, but similar enough to make cracking a passowd avery very tedious task). In other words hopefully the suggestions in the beginning of this post are enough-

[Toast]

a DB hack then thats probly what pietry wants so he can use his acc

[Pietry]

Ah, thanks Crise, it seems that indeed Firefox kept my password plain text ( which is kinda horrible if somebody snoops around my comp ! )
But the problem still remains for somebody that lost his pass...

[Crise]

Ah, thanks Crise, it seems that indeed Firefox kept my password plain text ( which is kinda horrible if somebody snoops around my comp ! )
But the problem still remains for somebody that lost his pass...

Well the password stored in the file system by firefox is actually encoded, but since the "show password" function is easily accessible it is a bit pointless... although it might be there is an option for master password for that function, haven't checked.