AspNetSqlMembershipProvider and PasswordRecovery Control

Question

Hi,

My scenario is I have a asp.net 2.0 application web application which had the AspNetSqlMembershipProvider properties as: enablePasswordRetrieval="false" and passwordFormat="Hashed"

But now the need has risen to store user's passwords unencrypted as clear text and display them to Superusers. I have done this by changing the AspNetSqlMembershipProvider properties to: enablePasswordRetrieval="true" and passwordFormat="Clear"

The problem is the way the PasswordRecovery control behaves. From what I have read it checks the properties of the AspNetSqlMembershipProvider tag if enablePasswordRetrieval="true" and passwordFormat="Clear" it will attempt to retrieve the password this is causing a problem when the password is effectively still stored as a hashed one. Is there any way of forcing the PasswordRecovery control to reset not retrieve the password when AspNetSqlMembershipProvider properties are enablePasswordRetrieval="true" and passwordFormat="Clear"?

Sorry for the long winded explanation, all help / pointers very much appreciated as always. Thank you.

Answer 1

I don't think you'll have any luck trying to use two methods for storing passwords in the database.

My advice is to change the passwords on the accounts that have hashed passwords so they get stored as plain text and move on from there.

Alternatively, if you must store some hashed and some clear-text passwords, you'll have to look at extending the membership provider to support this. In my experience, this is often more trouble than it's worth.

Answer 2

From what I've experienced changing password formats is problematical -- I don't think there's a way to make the provider automatically handle this for you.

You might want to consider forcing the hash-users to change their passwords the next time they login or simply write a process that goes through and resets their passwords in the database. There's a column in the password table (I can't look at one right now) that describes the format, so you could change that value from hash to clear and then the hash-value would be their clear-text password and should work to login.

Answer 3

Also, remember that there are legal implications of storing passwords in plaintext. If those passwords are abused or leaked, you are responsible for all the data that is compromised (including data accessed through any other services that you do not own, but the user used the same password for).