Convert ASP.NET membership system to secure password storage

Posted by wrburgess on Stack Overflow See other posts from Stack Overflow or by wrburgess
Published on 2010-03-11T22:31:17Z Indexed on 2010/04/19 15:03 UTC
Read the original article Hit count: 262

Filed under:

asp.net-membership

|

password-protection

|

hashing

|

salt

|

md5

I have a potential client that set up their website and membership system in ASP.NET 3.5. When their developer set up the system, it seems he turned off the security/hashing aspect of password storage and everything is stored in the clear.

Is there a process to reinstall/change the secure password storage of ASP.NET membership without changing all of the passwords in the database? The client is worried that they'll lose their customers if they all have to go through a massive password change.

I've always installed with security on by default, thus I don't know the effect of a switchover. Is there a way to convert the entire system to a secure password system without major effects on the users?

© Stack Overflow or respective owner

Related posts about asp.net-membership

Using the string resources of ASP.NET membership provider in a custom control

as seen on Stack Overflow - Search for 'Stack Overflow'
I have the request to build a custom control for ASP.NET membership. The control is somewhat special. So I can’t inherit from a built-in control. Is there an elegant way to access the string resources of ASP.NET membership provider to use them in custom controls? Creating for example CreateUserWizard… >>> More
Asp.Net membership via ASP.NET Website Administrator Tool

as seen on Stack Overflow - Search for 'Stack Overflow'
I created a database with aspnet_regsql, the database was created in sql sever 2008 and not in data folder in my project (do I need to move it to the folder manually?). Next, in Web Site Administration Tool I went to provider section and clicked don Test button. I got an error: Could not establish… >>> More
Avoid concurrent login (logout former login session) in ASP.net membership

as seen on Stack Overflow - Search for 'Stack Overflow'
I am learning the ASP.net membership feature. I am wondering how I can implement so that later login session logout former login session to avoid concurrent login. I know how to check whether the user is online (by Membership.IsOnline()) and logout the current user (by FormsAuthentication.SignOut())… >>> More
ASP.NET Membership with two providers cant use GetAllUsers method

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I'm using two membership providers. When I declared a following statement Dim allUsers As MembershipUserCollection = Membership.Providers("CustomSqlRoleManager").GetAllUsers Then, it gave me this error message. Argument not specified for paramenter 'totalRecords' of 'Public MustOverride… >>> More
How to set up asp.net membership with a web application instead of a web project

as seen on Stack Overflow - Search for 'Stack Overflow'
Originally the site was set up using a Website project which ended up not working for various reasons. I'm trying to make it work as a web application project and have started from the ground up with a new project. I have looked online and not found a good resource that explains some of the "simple"… >>> More

Related posts about password-protection

How good is PDF password protection?

as seen on Super User - Search for 'Super User'
It appears that Word's password protection is not really good, at least until Office 2003, if I read this SU entry correctly. I'm under the impression that Acrobat's PDF password protection should be better (it says 128-bit AES for Acrobat 7 and higher). Is that true? Of course, it depends on the… >>> More
How to remove password protection from compressed files

as seen on Super User - Search for 'Super User'
This has always been a problem for me for a long time. Let's see if any SuperUser can solve this: I have a directory in which there are lots of password protected .RAR files of which I know the passwords. I want to remove the password protection from all of them without extracting the contents… >>> More
How good is Word's password protection?

as seen on Super User - Search for 'Super User'
Hi, I have a password protected MS-Word 2007 file that needs to stay private. How good is Word's protection? If it's not very good, can you suggest a better method for keeping the file protected? EDIT: my goal is to send the protected file to a recipient (who knows the password). I assume this recipient… >>> More
Password protection by .htaccess file not working after deployment on a new server

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, I migrated my application to a new server (from a VPS to a dedicated) yesterday and the password protection which was working correctly on the previous server (using .htaccess file - asking username/pass) doesn't work anymore : anyone can access the website without being asked to enter a username… >>> More
PHP password protection question?

as seen on Stack Overflow - Search for 'Stack Overflow'
How do I use the sha512 function for PHP? Can I replace all my md5 funtions with the sha512 function? Do I have to download something if so what? Can any one provide examples? Thanks! >>> More