Convert ASP.NET membership system to secure password storage

Question

I have a potential client that set up their website and membership system in ASP.NET 3.5. When their developer set up the system, it seems he turned off the security/hashing aspect of password storage and everything is stored in the clear.

Is there a process to reinstall/change the secure password storage of ASP.NET membership without changing all of the passwords in the database? The client is worried that they'll lose their customers if they all have to go through a massive password change.

I've always installed with security on by default, thus I don't know the effect of a switchover. Is there a way to convert the entire system to a secure password system without major effects on the users?

Answer 1

Hopefully there's an automatic way to do this, but I suppose you could do it the hard way if you had to

Run all of the cleartext passwords through the membership system with the hash turned on to get the hashed version of the password, then update the database directly with the hashed version of the password.