var $secret - can I change it at any time or white is black?

amoooc · Post by **amoooc** » Wed Apr 20, 2011 10:46 pm

Hi!

I was reading about var $secret but I'm still confused.

Can I change var $secret for random number in my website at any time when website have members already? It will cause any problems in the future?

Please answer YES or NO and why... please

Post by **mandville** » Wed Apr 20, 2011 10:52 pm

http://docs.joomla.org/Help15:Screen.config.15
Secret Word. This is generated when Joomla! is first installed and is not changeable. It is used internally by Joomla! for security purposes.

it is used to salt passwords etc

amoooc · Post by **amoooc** » Wed Apr 20, 2011 10:54 pm

I was reading it already but there is no answer for my question. Can I change it multiple times at any time without breaking my website functionality and security?

jeffchannell · Post by **jeffchannell** » Fri Apr 22, 2011 11:36 pm

If you change it, all users (including your Super Administrator) will no longer be able to log in.

Post by **mandville** » Sat Apr 23, 2011 12:13 am

mandville wrote: This is generated when Joomla! is first installed and is not changeable. It is used internally by Joomla! for security purposes.

Jeff channell, me and the docs all say no, therefore you can change it

amoooc · Post by **amoooc** » Sat Apr 23, 2011 10:42 am

jeffchannell wrote:If you change it, all users (including your Super Administrator) will no longer be able to log in.

I'm changed var $secret in configuration.php and all users, including Super Administrator still are able to log in. So do you know whats going on? I'm totally confused.
Regards

amoooc · Post by **amoooc** » Sat Apr 23, 2011 11:03 am

So can someone just answer YES or NO... please.

jeffchannell · Post by **jeffchannell** » Sat Apr 23, 2011 6:18 pm

It's a "no", with a caveat: you CAN change it (nothing is preventing you!), but any hashed passwords stored in your database will be unusable.

antihack · Post by **antihack** » Tue Apr 26, 2011 3:59 pm

I agree with him though. I change the var secret frequently and never have any issues. I dont understand how someone can still login if its meant to break it.

But now Im just curious lol

amoooc · Post by **amoooc** » Tue Apr 26, 2011 4:18 pm

Yes, it's strange. I was asking few "Joomla experts" from my city :-) and they said that if I'll change secret word I'll be not able to login anymore. BUT ITS NOT TRUE. I see that nobody know :-).

It's really interesting! I'm curious as well. Maybe there is no answer. Maybe we ever don't need var $secret :-D Maybe we should vote! :DDD

So can I change var $secret at any time ?

If you want answer follow the white rabbit , than choose right pill

jeffchannell · Post by **jeffchannell** » Tue Apr 26, 2011 4:25 pm

It looks like I was wrong.

The secret is used in the generation of hashes, but once the password is saved it is no longer tied to the secret - the salt is already in the DB.

amoooc · Post by **amoooc** » Tue Apr 26, 2011 4:30 pm

So I'm assuming that if my "secret word" was exposed to public for some reason, all users accounts and passwords are not secure anymore and there is nothing I can do. I'm right?

antihack · Post by **antihack** » Tue Apr 26, 2011 4:31 pm

in theory. If the secret is exposed, changing the secret and reset all passwords put you back in the saddle. Meaning you secure once again.

amoooc · Post by **amoooc** » Tue Apr 26, 2011 4:43 pm

I'm not sure that you agree...
but
If I'm right, somebody who expose var secret to public (probably only I'm so stupid to do that :-D), should:

1. Logout from superadmin account;
2. change "var secret" in configuration.php;
3. Clear cache
4. Login to superadmin;
5. Change superadmin password;
6. Push all users to change password immediately or during next login.

The Joomla! Forum™

var $secret - can I change it at any time or white is black?

var $secret - can I change it at any time or white is black?

Re: var $secret - secret word - can I change it multiple tim

Re: var $secret - secret word - can I change it multiple tim

Re: var $secret - secret word - can I change it multiple tim

Re: var $secret - secret word - can I change it multiple tim

Re: var $secret - secret word - can I change it multiple tim

Re: var $secret - secret word - can I change it multiple tim

Re: var $secret - can I change it at any time? PLEASE HELP

Re: var $secret - can I change it at any time? PLEASE HELP

Re: var $secret - can I change it at any time? PLEASE HELP

Re: var $secret - can I change it at any time? PLEASE HELP

Re: var $secret - can I change it at any time? White is blac

Re: var $secret - can I change it at any time? White is blac

Re: var $secret - can I change it at any time or white is bl