How to decrypt customer password ?

[MOni]

Hi...
I need to decrypt customer password from customer table from zencart DB.
As i want to pass this password in email to customer when he create login on my site.
is it possible to decrypt ? n how?

[Kim]

The stock program uses a one-way encryption method and is not designed to be decrypted for security.

[MOni]

ohhh...
so no chance to get those passwords?
I really need it ...

[kuroi]

Zen Cart's password encryption uses the MD5 algorithm, which is, as Kim has said, is one-way. For good measure Zen Cart applies it twice.

Is it unbreakable? Well there are rumours that a team of Chinese cryptographers using a super computer have managed to crack the algorithm. So if you have a spare super computer and a big budget, I'd be happy to have a go.

Otherwise, why not explain why you need it and we'll see if there's an alternative solution to your underlying problem.

[kuroi]

Ah. I see you did explain why you need it in your original post.

To do this you would capture the password before it is encrypted and edit the new user email to use that data. BUT, I'd strongly advise against doing so. Companies that email me back my password (which I know 'cos I chose it) go straight on my "do not do business with people who exposure my password to the whole world" list.

[MOni]

Hi Kuroi ...

Thanks for ur reply and ur advise.
I have to change my mind to send user's pwd into email.
I thought its also a way that user may get easy to get pwd any time. but ya... this is some wt not good at security level...
I'll think for the next option..
thanks again...

[digitalmark]

I have a client who's leaving the ZenCart installation after several years. It would be very customer friendly for them to transfer the usernames, emails, and keep existing customer passwords in their new system. How would we be able to do that? And does Zencart anything that the new vendor may be able to work to use existing passwords in their system?

[kuroi]

@digitalmark

The Zen Cart user name and email are the same. Some systems don't like this.

Zen Cart's password security is as good as any that I have seen and way ahead of most. To make use of existing passwords you would need to replace all the new system's code for collecting and checking passwords with the equivalent Zen Cart code - this is likely to be a major and high risk project.

Why is your client moving away from Zen Cart? Are the reasons sufficient to justify what will be a significant cost to maintain passwords and their security?

[nrg77]

I think a good use for decrypting would be if ever the store owner wanted to change the e-commerce platform to something else...say Magento but want to keep the existing customer database. Another words the customers can login with their past account info on the new shopping cart without having to re-create a new account or password...

[kuroi]

So Zen Cart should compromise its own security to make it easier for people to transfer to other carts ... ?