[Discussion] Downtime and Server Compromise

[gonzoateafly]

There's a little point I'd like to be totally clear about. In the original "Downtime and Server Compromise" post at viewtopic.php?f=71&t=29973

phpBB3 is set to convert phpBB2 hashes to the new phpBB3 standard during the first user login.

Many of the later posts suggest that users must actually change their passwords following phpBB2 to phpBB3 conversion in order for this hash conversion to take place. Is this true? I interpreted Marshalrusty's original statement as meaning that the hash conversion takes place automatically without requiring the user to change their password. Which is it? Note that while phpBB3 does include an option to require password changes after certain time intervals, that option isn't enabled by default. And users normally aren't prompted to change password following a phpBB2 to phpBB3 conversion.

Users passwords are only changed once they log in after the upgrade has been made. Remember when you first logged in after the change, and it told you it needed to update your password? That's when the change is made. So if you didn't log in after the phpbb3.x was installed, it's still in the old hash.

[bbrunnrman]

Users passwords are only changed once they log in after the upgrade has been made. Remember when you first logged in after the change, and it told you it needed to update your password? That's when the change is made. So if you didn't log in after the phpbb3.x was installed, it's still in the old hash.

I've definitely logged in after the phpBB2 to phpBB3 upgrade, both on phpbb.com and on my own board, but I don't remember being told that it needed to update my password, and I definitely wasn't prompted to change my password.

[gonzoateafly]

If you logged in since the update, you're safe.

[ToonArmy]

Users passwords are only changed once they log in after the upgrade has been made. Remember when you first logged in after the change, and it told you it needed to update your password? That's when the change is made. So if you didn't log in after the phpbb3.x was installed, it's still in the old hash.

I've definitely logged in after the phpBB2 to phpBB3 upgrade, both on phpbb.com and on my own board, but I don't remember being told that it needed to update my password, and I definitely wasn't prompted to change my password.

It doesn't prompt you, it just does the conversion.

[gonzoateafly]

It doesn't prompt you, it just does the conversion.

Hmm, ok, I should say some of the time it prompts you. I was forced to do it on my personal forums on a couple of them.

[bbrunnrman]

It doesn't prompt you, it just does the conversion.

Hmm, ok, I should say some of the time it prompts you. I was forced to do it on my personal forums on a couple of them.

Maybe I've figured out the source of the confusion. When some users try to login the first time after phpBB2 to phpBB3 upgrade, they get an error message that the system couldn't update their password (and I think they end up having to use the "forgot password" feature to get a new one). These are probably cases where an error occurs trying to produce the new salted hashes. But this happens to only a small percentage of users. For most, the system does the conversion automatically, and they can keep logging in with their old passwords.

[gonzoateafly]

Hmm, ok, I should say some of the time it prompts you. I was forced to do it on my personal forums on a couple of them.

Maybe I've figured out the source of the confusion. When some users try to login the first time after phpBB2 to phpBB3 upgrade, they get an error message that the system couldn't update their password (and I think they end up having to use the "forgot password" feature to get a new one). These are probably cases where an error occurs trying to produce the new salted hashes. But this happens to only a small percentage of users. For most, the system does the conversion automatically, and they can keep logging in with their old passwords.

That would be my guess.

[ToonArmy]

There are quite a few variables in the password conversion process, but generally a phpBB2 -> phpBB3 conversion the update should be performed automatically.

[MartinTruckenbrodt]

Hello,
perhaps you should use phpBB3 insteat of PHPlist for sending newsletter emails: http://www.martin-truckenbrodt.com/cgi/ ... m.php?f=13

Bye Martin

[a_o_c]

i dont think the DEVs are going to be adding MODs to .com