Question

We are creating a new site using ASP.NET membership provider for user registration and log in. Our old system encrypted user passwords so that we could recover them if we needed to.

I am having a great deal of trouble figuring out if it is possible to use ASP.NET membership functions to simply encrypt the password when the user registers and then unencrypt it so I can see it.

Documentation for this is neigh non-existant.

I know how to configure Web.config to have it store passwords as encrypted ala
passwordFormat=”Encrypted” in the provider and assigning a validationKey in the machineKey, however it seems like the password still gets hashed (though perhaps it is just well encrypted). Either way I cannot decifer how the password can be recovered (by us) if neccessary.

Thanks!

Answer 1

Storing passwords in recoverable format is a very poor idea. If you can recover them so can anyone who breaks into your server.

You’re better off using a standard hash+salt approach and having a password reset mechanism to handle the case where users forget their password.