7

I have a site where I open accounts for users and hand over login credentials to them.

Now, Let's say that a user forgot his password, and wants to reset it. He clicks "Lost your password?" link on the login page and a new password is then automatically sent to his mail box.

Being the admin, is there any way that I could check this user's new password without resetting it?

The reason for this is that I always have to have access to registered users' accounts.

Thanks!

  • Even if you want to impersonate the user, you shouldn't log in using their password. You should use (implement if necessary) a special impersonation feature accessible to admins. – CodesInChaos Apr 24 '15 at 11:59
  • @CodesInChaos, could you possibly elaborate on it? Thanks – luqo33 Apr 24 '15 at 12:12
9

The user passwords are stored in one-way encription. Even looking at the database you can not know the password. This is a very basic privacy feature. Most users use the same password on multiple sites; imaging the potential risks for users if the administrator of the site can access to their passwords. You can intercept the password from and get access to it, but that is a really very bad practice. If I would know that a site where I'm registering is storing my password in a human readable way, or trying to intercept the password, I probably would notice to privacy protection goverment agency in my country, maybe not, but I would stop using that website for sure.

That being said, you, as admin, don't need the password to access user profile or user data. The administrators have access to most of the profile fields directly in the admin area, and of course through database. New or custom fields in user profiles can be coded with or without admin access, that is totally up to you. So I don't get the point to getting the users passwords.

  • 3
    This is reasonable. Actually, I realized it was a bad ideo after positng this question. Thanks for detailed explanation. – luqo33 Apr 24 '15 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.