How to get an old password in ORM?

Question

I need an old password (not hashed) for sending to user but doesn't see a good idea? I read the documentation and there is only a method where I can get a hashed password. What can I do for getting real password?

Answer 1

Password should never be recovered clean after they are hashed and most of the time it's not even possible. I definitely suggest you to provide a reset password link instead of providing the old one.

Hashed password with MD5, SHA1, SHA2, Blowfish and others are one way encrypted this means that you shouldn't be able to decrypt them therefore making them secure (the first ones aren't that secure actually, but that's off topic here).

Answer 2

You can't get the original password; that is the point of using a hash.

If the user needs a new password, then generate a one-time, short-lived, random string and email it to them as part of a URL. When they follow the link, prompt them for a new password.

See the OWASP Forgot Password Cheat Sheet for more advice on how to do this as securely as possible.

Answer 3

You can't recover old password (unhashed) because its not stored in database. Only its hash is stored. Hashed can't be decrypted (that is why its called hash) ORM uses this model to solve alot of security issues.

Sending raw Password is real BAD idea. If you still want to do it:

1. If you are generating a password yourself during registration (Then mail it to user and then save it)
   
2. If user are setting their password. You will have it as POST variable. While saving it to database, mail it too.
   
3. If user is using forgot password to recover their password. Then reset the password first (generate a new one and save it to database) and send it to user.

Answer 4

You can't. A hashed password in Kohana is most likely a password encrypted with one-way encryption. I mean you can't decrypt it and get it in clear text. You should not store your applications password in clear text to protect the user.

http://en.wikipedia.org/wiki/Cryptographic_hash_function

What you may do is to generate a new temporary password for the user and send it to the users email, but I think reset password link is the best solution.