Master Key can be retrieved by using a Temporary Master Key

[jmguzmanc]

Hi

From the docs I read:

For the temporary master key generation the real master password is encrypted using a secure key generated by openssl_random_pseudo_bytes. Then a Blowfish generated hash of it is stored in the database “”Config” table.” in order to check it when the temporary master key is provided on login.

So, a user with access to tha database, could be able to decrypt the master key from the temporary maste key?

[nuxsmin]

Hi,

So, a user with access to tha database, could be able to decrypt the master key from the temporary maste key?

Partially yes, because the master key is encrypted using a secure key that is protected by the "password" sent to the user as "temporary master password", so the user would need to unlock the secure key and then decrypt the master key.

Regards