Pacweb Internet

ASP.NET Membership Encrypted Passwords

To keep your passwords secure but still be able to retrieve the password via the ASP.NET membership provider you will need to implement the password type as Encrypted.

To do this you need to provide a machine key in the web.config of machine.config.

You can find a machine key generator at:  http://www.developmentnow.com/articles/machinekey_generator.aspx

The membership code looks like:

<membership defaultProvider="BfssSqlMembershipProvider">
  <providers>
    <!-- Add a customized SqlMembershipProvider -->
    <add name="BfssSqlMembershipProvider"
    type="System.Web.Security.SqlMembershipProvider"
    connectionStringName="cstrBFSS"
    enablePasswordRetrieval="true"
    enablePasswordReset="true"
    requiresQuestionAndAnswer="true"
    applicationName="BusinessForSaleSpain"
    requiresUniqueEmail="false"
    passwordFormat="Encrypted"
    maxInvalidPasswordAttempts="5"
    minRequiredPasswordLength="7"
    minRequiredNonalphanumericCharacters="0"
    passwordAttemptWindow="10"
    passwordStrengthRegularExpression=""/>
  </providers>
</membership>
<machineKey
  validationKey="7D69B8F7D5D4A9D6CC9776D6972877FC1ACA7669
    650687987EBF3C2A1709E0065AAA13ECABF4193A65920A027588
    42EF9EA97FDAC57C2F40F808AD1FFD9145"
  decryptionKey="CB0CE75BFD315E2108A96F95384BA8E28AE2AF97
    03F42B7D369EE44C09C394A6"
  validation="SHA1" decryption="AES"
/>

Please make sure you generate your own machine key.

For further information about ASP.NET Membership please visit: http://msdn.microsoft.com/en-us/library/ff648345.aspx