pandora archive

[kloplop321]

just to tell openpandora.org owners/admins people can see your database's username on the archive since it is down(though it does not show the pass) (Oh darn :lol: I wonder what it is like inside)
Well I hope you guys fix this issue soon, I don't know why someone would screw with the site so deeply since preorder day.

 

[ryan0]

A forum database file does not contain passwords of users if that's what you're thinking XD,well it does,but they are encrypted.

 

[Zarneth]

Most likely the passwords are stored as an MD5 hash. This is basically an irreversible encryption. Whenever you log in it the password you entered by making the hash and comparing it to the hash on file. So even if you could see the passwords hash (the site would need to be programmed by a retard for that to happen) it wouldn't tell you the password.

 

[fakename]

Are you kidding?

MD5 can be broken quite easily.

See the wikipedia page, complete with code examples!
http://en.wikipedia.org/wiki/MD5

 

[EvilDragon]

Hiya,

don't worry - you might remember I had to move this site to a new server because of the massive hits we got when preorder started.
I moved the archive as well but didn't have time to setup the database.
So even if you got some passwd and username - it won't work, 'cause it was from the old server, the new one got everything new

But, the new archive has been setup already.

 

[Drack]

Are you kidding?

MD5 can be broken quite easily.

See the wikipedia page, complete with code examples!
http://en.wikipedia.org/wiki/MD5

The listed code generates the md5 from data, not a set of data that generates a given md5.

Also, the password md5s aren't even exposed, and as mentioned above, the site has been restarted anyway.

Stop your fearmongering.

 

[Kyosys]

the md5s weren't exposed, but he's right with saying that MD5s can be cracked quite easily. They are no real protection.

 

[PSyMastR]

MD5 hashes can be found easily though. Try a real encryption like sha512 or haval256,5

 

[cosam]

All valid points on the MD5 stuff. The OP was however about the credentials used by the forum application to access its database being displayed in the user's browser. This has nothing to do with the passwords of forum accounts or how these may or may not be stored. Anyway, as the problem has now been solved, and before this turns into a lengthy discussion of hashing algorithms, I think this topic can be locked.