Use custom shop-account, in other application

[holger]

Hello,

i write a webservice for mobile-application and i would use the customer account from shop for a account at the new webservice. The customer don't make a new account. The software buys the customer in the Shop and limit serves is available thereby. The password in database is cryt. I would like to compare the crypted password, but as it is there crypt? A MD5 hash?

regards
Holger

[ryan]

Hi,

At the moment we use an algorithm compatible with osCommerce which uses an MD5 hash.

-Ryan

[holger]

Hi ryan,

okay, thanks!

regards,
Holger

[holger]

Hey Ryan,

if have write a smal tool, to make a MD5 Hash for check account from my appication to the Konakart-Dtabase.

This is the value in Database:

0cc61484f797d1fc36bb06342a9592c0:a3

and this is my value from my MD5 hash:

6961a718bf46a72b1b9890b7c6fdf4ba



I use this C# code,  in some forum's i find it....


        ^{public string MD5(string password)
        {
            byte[] textBytes = System.Text.Encoding.Default.GetBytes(password);
            System.Security.Cryptography.MD5CryptoServiceProvider cryptHandler;
            cryptHandler = new System.Security.Cryptography.MD5CryptoServiceProvider();
            byte[] hash = cryptHandler.ComputeHash(textBytes);
            string ret = "";
            foreach (byte a in hash)
            {
                if (a < 16)
                    ret += "0" + a.ToString("x");
                else
                    ret += a.ToString("x");
            }
            return ret;
        }}


I use konakart 2.2.10 and a Oracle11g

Have you a idea with the difference?

regards,

Holger

[ryan]

As I said above, our algorithm is compatible with the one used by osCommerce. Just do a google search on oscommerce md5 and you'll find plenty of examples.

[pawlorj]

I know this post is over 2 years old, but I thought this might help someone else.

Here is the way that passwords are stored in the customers table in Konakart (and oscommerce):

bb2c19e53d9603b7750ab18edb8f632b:8f

The hex string before the ':' is the md5 hash of the plain text password pre-pended by the two random characters after the colon.

So if the plain text password is 'password' (without the quotes), you should run '8fpassword' through your md5 hash generator.  It will return:

bb2c19e53d9603b7750ab18edb8f632b