3 ms·
I had to ask this as I am dealing with a DotNetNuke based system right now which stores authentication details in a table (aspnet_membership) with the passwords
by desigooner 15y ago
I had to ask this as I am dealing with a DotNetNuke based system right now which stores authentication details in a table (aspnet_membership) with the passwords encrypted with a private key (in web.config in IIS) and a password salt.
How would one go about securing such a system where there is no option but storing encrypted passwords that are reversible?!
- deleted 15y ago[deleted]
- aaronblohowiak 15y ago> "How would one go about securing such a system where there is no option but storing encrypted passwords that are reversible?!" Change the system.
- desigooner 15y agoI wish it was that easy. Working in higher ed means dealing with legacy and proprietary systems at low budgets. "Change the system" isn't always the option in the real world a lot many times.
- ams6110 15y agoYou can change it so that DotNetNuke (really aspnet_membership) uses hashed passwords. They are then not recoverable, but DotNetNuke will allow a user to request a new password which is then emailed (rather than a slightly safer "reset password" link)