[NOT A BUG] WHMCS & Password secure?

[mpkossen]

It occured to me what WHMCS sends passwords to people. Not only is this a security risk in itself, it also means that passwords in the database are not secure in a sense that they can be decoded back to a normal password (a sha1-encoded password virtually cannot be decoded) even though they are encrypted in the database.

 

I'm wondering why WHMCS sends passwords and why then can be decoded?

Edited November 8, 2010 by Matt

[WHMCS John]

If you don't want to email passwords to clients then remove the field from the email template (Setup > Email Templates > Edit). Only hosting account passwords are stored in a reversable manner by default unless you disable the MD5 client passwords under Setup > General Settings > Security Tab.

[mpkossen]

I've removed it from the templates already. Thanks for the tip, though

 

I'm really sorry, I've just noticed that MD5-passwords can only be disabled via the admin area and that it resets all passwords. Would the template field have worked with MD5-encrypted passwords? Or would it have been empty?

Edited November 8, 2010 by mpkossen

[WHMCS John]

When using the MD5 option for client passwords they can't be decoded and so wouldn't be included in the emails. If you change this on an active install please refer to http://wiki.whmcs.com/Security_Tab#Disable_MD5_Clients_Password

[mpkossen]

OK, thanks. Any plans to support sha1 in the future?

[laszlof]

To clarify a little bit, the client area password, even with MD5 enabled, will get emailed. However, it is emailed before it is actually encrypted and entered into the database. As John stated, you can simply remove the password from the email templates if you do not wish for your clients to receive them.

 

That being said, I wrote a "secure password reset" module that basically removes the need to include client area passwords within the templates. It basically takes the normal password reset function, and makes it a bit more secure. When you receive the password reset email, it redirects you to another page where you can enter your new password. It never actually will get sent to you after this is done. The current way the password reset works is, when you click on the reset link in the email, it will send you a temporary password within another email.

 

I'll probably release this as a free module here shortly once I've had time to work out any potential bugs. We've been using it in production for a few weeks now without any major problems.