CODEWITHSUNDEEP
c#mongodbmeteormeteor-accounts
Omar Barrera Valentin
Omar Barrera Valentin

Reputation: 153

How to decrypt password in Meteor

is possible decrypt this type of password generated by Meteor application.

enter image description here

My idea is to use the same credentials (email and password) for my application in C #

enter image description here

Upvotes: 1

Views: 1666

Answers (4)

swilliams511
swilliams511

Reputation: 118

I encountered a similar use case where I was writing a C# application that would validate users created through a Meteor.js application. The code I got to work was this (using System.Security.Cryptography and BCrypt.Net-Next):

string sha256_hash(string value) {
    StringBuilder stringBuilder = new StringBuilder();

    using (SHA256 hash = SHA256.Create()) {
        Encoding enc = Encoding.UTF8;
        Byte[] resultingHash = hash.ComputeHash(enc.GetBytes(value));

        foreach (Byte b in resultingHash) {
            stringBuilder.Append(b.ToString("x2"));
        }
    }

    return stringBuilder.ToString();
}

// First compute SHA256 hash
string sha256hash = sha256_hash("my_password");

// Let BCrypt.Net rehash and check if it matches Meteor's hash
if (BCrypt.Net.BCrypt.Verify(sha256hash, dbPassword) == true) {
    Console.WriteLine("Valid!");
}

Upvotes: 1

Jesper We
Jesper We

Reputation: 6087

As noted in other answers, you cannot decrypt the passwords, but you can very well use the Meteor database to authenticate in a different system.

This is how to do it:

In your other system, first find libraries that provide SHA256 and bcrypt implementations.

Then take the password as entered by the user, and first compute a SHA256 digest hash from it.

Then feed this hash string to bcrypt using number of rounds = 10 (This is the Meteor default).

Now compare the result from bcrypt with the services.password.bcrypt from the MongoDB database of Meteor. If they match, the user provided the correct password.

For reference, the Meteor implementation is here. It is quite simple and well commented.

Upvotes: 3

Mathieu K.
Mathieu K.

Reputation: 933

The very purpose of hashing and encrypting your password is to make decrypting them unpractical.

However, you can reuse the bcrypt(hash(password)) from your meteor app and check against it in another application, provided you use the same scheme.

Upvotes: 2

EngineerExtraordinaire
EngineerExtraordinaire

Reputation: 119

Is that a bcrypt hash? It depends on the size of the key as Blowfish as a variable sized key. If it's 32 bits. Sure, you could do it with some serious computing power and a few hours. It it is a 128bit key, you'd be long long dead (and so would the universe as we know it) before it every finishes brute forcing. Blowfish does have a minor vulnerability for weak keys though. I would rethink your implementation.

Upvotes: 1

Related Questions