MyBB Community Forums › Community Archive › Archived Forums › Archived Development and Support › MyBB 1.6 › 1.6 Security Management and Support v
Password recovery through mobile?

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Threaded Mode
Password recovery through mobile?
Doxer Offline
Posts: 15
Threads: 5
Joined: Apr 2013
Reputation: 0
#1
2013-10-05, 06:25 PM
This user has been denied support. This user has been denied support.
Given it good thought. What if MyBB users could recover their accounts through mobile as an addition to recovery through email? These phone numbers could also be hidden from administrators in the ACP and possibly encrypted in the DB just like passwords are.

Give me your opinions below! Cool
Website Find
Arbaz Offline
Posts: 1,579
Threads: 62
Joined: Jul 2013
Reputation: 124
#2
2013-10-07, 03:06 AM
Nice idea but too much coding I believe. Some people don't feel safe giving out their cell phone numbers either. The new 2-factor auth feature in 1.8 should make the accounts harder to compromise.
Find
Josh H. Offline

Former Staff
Posts: 3,791
Threads: 80
Joined: May 2011
Reputation: 94
#3
2013-10-07, 10:49 PM
(2013-10-05, 06:25 PM)Doxer Wrote: Given it good thought. What if MyBB users could recover their accounts through mobile as an addition to recovery through email? These phone numbers could also be hidden from administrators in the ACP and possibly encrypted in the DB just like passwords are.

Give me your opinions below! Cool
It wouldn't work just like passwords. Passwords are one-way hashed and compared upon login. Phone numbers would need to be encrypted with something like key authentication, which as Arbaz said, would require a significant amount of code to implement.
PGP Key (Fingerprint: 23B6 F4C0 FE2D 45AA 61A0 1E86 DB87 09DC DD87 6E40)
Website Find
Krytic Offline
Posts: 825
Threads: 61
Joined: Mar 2012
Reputation: 49
#4
2013-10-08, 12:49 AM
(2013-10-07, 03:06 AM)Arbaz Wrote: Nice idea but too much coding I believe. Some people don't feel safe giving out their cell phone numbers either. The new 2-factor auth feature in 1.8 should make the accounts harder to compromise.

Has 2 factor auth been confirmed? I thought the team was still discussing whether or not to do it based on it's feasibility.
Please don't PM me for support. Smile
Find
Arbaz Offline
Posts: 1,579
Threads: 62
Joined: Jul 2013
Reputation: 124
#5
2013-10-08, 03:51 AM (This post was last modified: 2013-10-08, 03:51 AM by Arbaz.)
(2013-10-08, 12:49 AM)Seabody Wrote:
(2013-10-07, 03:06 AM)Arbaz Wrote: Nice idea but too much coding I believe. Some people don't feel safe giving out their cell phone numbers either. The new 2-factor auth feature in 1.8 should make the accounts harder to compromise.

Has 2 factor auth been confirmed? I thought the team was still discussing whether or not to do it based on it's feasibility.

It's still pending (As far as I know from the Roadmap).
Find
JordanMussi Offline

Former Staff
Posts: 3,423
Threads: 100
Joined: Aug 2011
Reputation: 157
#6
2013-10-11, 03:56 PM
The roadmap says that it's research.
Tomm M Wrote: RESEARCH: Security questions for forgot password/change email/password (is 2-factor auth possible?)

It would be good to have it implemented but it may be a bit of effort to code. A developer may have been looking into it in more detail...
Extend MyBB • github.com/JordanMussi • 🔑 keybase.io/jordanmussi
Website Find
Doxer Offline
Posts: 15
Threads: 5
Joined: Apr 2013
Reputation: 0
#7
2013-10-12, 12:41 AM
This user has been denied support. This user has been denied support.
True I agree with you all, that a lot of coding would indeed be a factor. But hey, that's what development is all about. Anything to keep our accounts more secure would be well worth looking into, thanks MyBB team.
Website Find
Stefan C. Offline
Posts: 84
Threads: 4
Joined: Apr 2013
#8
2013-10-12, 06:34 AM
(2013-10-05, 06:25 PM)Doxer Wrote: Given it good thought. What if MyBB users could recover their accounts through mobile as an addition to recovery through email? These phone numbers could also be hidden from administrators in the ACP and possibly encrypted in the DB just like passwords are.

Give me your opinions below! Cool

The passwords are not encrypted. They are hashed. Even if you were to 'hide' the passwords in the AdminCP, it would only be a matter of getting into the database and finding the encryption key and algorithm..
Find


Forum Jump:


Users browsing this thread: 1 Guest(s)