2

I have a potential client that set up their website and membership system in ASP.NET 3.5. When their developer set up the system, it seems he turned off the security/hashing aspect of password storage and everything is stored in the clear.

Is there a process to reinstall/change the secure password storage of ASP.NET membership without changing all of the passwords in the database? The client is worried that they'll lose their customers if they all have to go through a massive password change.

I've always installed with security on by default, thus I don't know the effect of a switchover. Is there a way to convert the entire system to a secure password system without major effects on the users?

Randy Burgess
  • 4,835
  • 6
  • 41
  • 59
  • Let me know if you still need help coming up with a solution. I'm sure I could come up with something, but it will take a while – Greg Mar 12 '10 at 14:46
  • I'll give those ideas a shot...i'll have to test it on a dummy site, first, of course. – Randy Burgess Mar 13 '10 at 15:20

1 Answers1

1

Hopefully there's an automatic way to do this, but I suppose you could do it the hard way if you had to

Run all of the cleartext passwords through the membership system with the hash turned on to get the hashed version of the password, then update the database directly with the hashed version of the password.

Greg
  • 16,540
  • 9
  • 51
  • 97
  • 1
    You could actually ease this using this code: http://davidhayden.com/blog/dave/archive/2004/02/16/157.aspx which will allow you to do it enmasse with a little modification. – Keith Adler Mar 11 '10 at 22:42