Hacker News Reader

I had to ask this as I am dealing with a DotNetNuke based system right now which stores authentication details in a table (aspnet_membership) with the passwords encrypted with a private key (in web.config in IIS) and a password salt.

How would one go about securing such a system where there is no option but storing encrypted passwords that are reversible?!

View on HN

You can change it so that DotNetNuke (really aspnet_membership) uses hashed passwords. They are then not recoverable, but DotNetNuke will allow a user to request a new password which is then emailed (rather than a slightly safer "reset password" link)

> "How would one go about securing such a system where there is no option but storing encrypted passwords that are reversible?!"

Change the system.

I wish it was that easy. Working in higher ed means dealing with legacy and proprietary systems at low budgets. "Change the system" isn't always the option in the real world a lot many times.

Reply on news.ycombinator.com