Decoding django user password

[Miguel]

Hello,

is there any way to decode the passwords that django keeps the the auth_user table? It would be really interesting to see if there is any problems in the users part of the web when new information and tasks are added via admin web.

regards,



Miguel
Sent from Madrid, Spain

[Masklinn]

On 29 Apr 2009, at 13:47 , Miguel wrote:
> Hello,
>
> is there any way to decode the passwords that django keeps the the
> auth_user
> table?

No. The passwords are stored salted hashes (http://en.wikipedia.org/wiki/Salted_hash
), you can try brute-forcing them if you have *a lot* of time (and cpu
time) to waste.

[Karen Tracey]

On Wed, Apr 29, 2009 at 7:47 AM, Miguel <migu...@gmail.com> wrote:

Hello,

is there any way to decode the passwords that django keeps the the auth_user table? It would be really interesting to see if there is any problems in the users part of the web when new information and tasks are added via admin web.

No.  For more information search the list and you'll find, for example, this thread:

http://groups.google.com/group/django-users/browse_thread/thread/5cce44d27cc6b0cc/

which details why and why that is a good thing.

If you want to test things out as they would be seen by a non-staff, non-superuser user, why not just define one (or more) for testing purposes and use them?  It shouldn't be necessary to actually log in as one of your real users for testing purposes.

Karen

[Kenneth Gonsalves]

On Wednesday 29 April 2009 17:17:42 Miguel wrote:
> is there any way to decode the passwords that django keeps the the
> auth_user table?

afaik it is one way only
--
regards
kg
http://lawgon.livejournal.com

[Ned Batchelder]

If you want to login as a user, don't bother with their password (which
can't be decoded anyway). Build another authorization mechanism into
your app so that you can log in as them without a password. For
example, you can accept a user name with a password of (superuser name,
superuser password) and then log the user in. More details here:
http://stackoverflow.com/questions/263367/how-do-you-support-a-web-app-with-hashed-or-encrypted-passwords

--Ned.
http://nedbatchelder.com

--
Ned Batchelder, http://nedbatchelder.com

[Miguel]

thank you guys!

Miguel
Sent from Madrid, Spain