# Added restful authentication features

**URL:** <https://www.ruby-forum.com/t/added-restful-authentication-features/177928>\
**Category:** Rails\
**Created:** [October 26, 2009, 9:23pm UTC](https://www.ruby-forum.com/t/added-restful-authentication-features/177928 "2009-10-26T21:23:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![biqut2](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f475e1/32.png) [@biqut2](https://www.ruby-forum.com/u/biqut2)\
**Post date:** [October 26, 2009, 9:23pm UTC](https://www.ruby-forum.com/t/added-restful-authentication-features/177928/1 "2009-10-26T21:23:59Z")

</div>

Pardon mf ignorance but what is the easiest way to take the  
crypted\_password that the restful authentication plugin stores in the  
DB and extract the real password from it so that it can be placed in a  
variable and then used in a view? I have seen some sources where  
people are implimenting a forgot and reset function but I just want to  
get at the password after its been stored.

---

<div class="post-metadata">

**Author:** ![biqut2](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f475e1/32.png) [@biqut2](https://www.ruby-forum.com/u/biqut2)\
**Post date:** [October 26, 2009, 9:45pm UTC](https://www.ruby-forum.com/t/added-restful-authentication-features/177928/2 "2009-10-26T21:45:04Z")

</div>

On Oct 26, 4:22 pm, h3avyarms [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Pardon mf ignorance but what is the easiest way to take the  
> crypted\_password that the restful authentication plugin stores in the  
> DB and extract the real password from it so that it can be placed in a  
> variable and then used in a view? I have seen some sources where  
> people are implimenting a forgot and reset function but I just want to  
> get at the password after its been stored.

You don’t. The password isn’t actually encrypted; rather an SHA1  
digest of the password is stored in the DB.

Encryption is difficult, and secure management of the necessary keys  
is perhaps moreso, so unless its a _requirement_ (preferably a somehow  
reasonable one) that users’ passwords be re-retrievable, just  
implement password reset functionality and be done with it.

---

<div class="post-metadata">

**Author:** ![biqut2](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f475e1/32.png) [@biqut2](https://www.ruby-forum.com/u/biqut2)\
**Post date:** [October 26, 2009, 10:30pm UTC](https://www.ruby-forum.com/t/added-restful-authentication-features/177928/3 "2009-10-26T22:30:35Z")

</div>

pharrington wrote:

> On Oct 26, 4:22�pm, h3avyarms [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > Pardon mf ignorance but what is the easiest way to take the  
> > crypted\_password that the restful authentication plugin stores in the  
> > DB and extract the real password from it so that it can be placed in a  
> > variable and then used in a view? I have seen some sources where  
> > people are implimenting a forgot and reset function but I just want to  
> > get at the password after its been stored.
> 
> You don’t. The password isn’t actually encrypted; rather an SHA1  
> digest of the password is stored in the DB.

To be more clear: the impracticality of reversal is the point of using  
hash functions for storing passwords. It annoys me if I ever find out  
that a site is able to “retrieve” my passwords. So much so that I  
strongly consider not using the site at all.

Password recovery by resetting is the “right” solution.