Question

I’ve developed a website that uses ASP.NET membership. Based on comments from previous sites, I decided to encrypt passwords so they could be recovered for users who forgot them.

However, the new site (which now has over 500 registered users) has brought me some criticism that the industry standard is really to hash passwords.

However, after a fairly extensive search, I have been unable to find anything about how to convert existing users’ passwords from encrypted to hashed.

I know I can change the web.config file, and new users’ passwords will use the new format. But it does nothing to update the existing users.

Note: I previously asked a similar question but mostly just got a debate about which is better, encrypted or hashed. I’m past that discussion but I’ve been unable to find a way to convert them without losing the hundreds of users already registered.

Answer 1

IMHO, Greg’s response (and the associated comments) on your previous question (Changing passwordFormat from Encrypted to Hashed) is the way to go. Essentially, you want to:

1. Add a hashed membership provider
2. Loop through all of the encrypted password users,
3. For each one decrypt the password, create the hash, store it, delete the encrypted version from the database, and move on.

When you are done, all of the encrypted password users should be converted to hashed.