I have a .Net 1.1 app that must be upgraded to 2.0. The application encrypts passwords in the database using MD5CryptoServiceProvider. After I upgraded to 2.0, the MD5 value was different. In the machine.config, the machinekey was set to autogenerate. Is there a way to retrieve this key?
View 2 Replies
I use MS SQL SERVER DB to store some servers' info with help of ASP.NET application and I want to know the strong way to encrypt and decrypt server's passwords and store them in that DB.
provide me the way in details + code since I didn't deal with encryption before..
My issue today is that i have a MySQL Database and am using the security framework provided by the ASP.NET Membership and Role Providers...I override the default methods with my own MySQL.
Now the issue comes in when i someone would like to have their password reset. My application is running entirely on an Intranet so i cannot have their passwords emailed to them. Is there a way i can have this information displayed in any way so that the user can use it to Log Reset, Create Accounts or Recover their lost passwords on an intranet without the administrators intervention?
Recently i had an approach as follows. In my web.config<system.net><mailSettings><smtp deliveryMethod="pickupDirectoryLocation" and my location was a folder on C drive as c:/SavedPasswords. Now i understand this was such a big security threat and thats why i am looking for a better option.
I would have that folder created using my System.IO and then the Mail is dropped into that folder. Then after the process is successful, i tell the user to check into that location and Read its content.
Then there is a global variable that is set to true...meaning that the folder at c:/ has been created. then there is a Method in a certain class that once it sees this variable True, it reads the readers c:/ and deletes that folder "save" if it exists;
I have a small database, with a very small number of users. The passwords were stored as clear as the database was so small and held no sensitive data. The database is now to be expanded and passwords are required to be encrypted. I can change the Password Format in the web.config, but is there a way to change the existing passwords from clear to encrypted?
View 1 RepliesI would like my website to fetch the data for username and password from a database in SQL server and authenticate that. I have used a login control in the website.
Presently I can assign username and passwords using the 'login control' from the website administration tool.
i dont realy understand how do i encrypt / decrypt using asp.netall the explainations in MDSN are hard.
i want to encrypt to database, decrypt from database.
I have a website which has reference to a service layer through which it calls the procedures.I have a web.config file in my service layer.I want to know is that possible to encrypt the database password alone in connection string.if so how it could be done using Enterprise library 5.0.And whether encrypted password should be decrypted before procedure call or it would automatically take decypted value for procedure call.
View 1 RepliesI have some sensitive data that will be stored in one of my database tables, how would I go about encrypting it while saving it to the database and then decrypting it when retreiving it? I am using VB.NET
View 2 RepliesI used below class to change data to some code and save it in database
public class ClsCrypt
{
public ClsCrypt()
{
//
// TODO: Add constructor logic here
[Code] ......
and
_cmd.Parameters.AddWithValue("@PassWord", ClsCrypt.computeMD5Hash(Txtpass.Text));
I wrote above code in insertbutton event for saving users password in database... Now In other page I want shows password in lable but in database it save it like code and didn't show it in label... So for showing password(that save in database with code) in label what should I do? Can I change code and show it in label?
I want to save my password and it sould be saved in encryptd form in my db SQl Server in asp.net.
View 1 RepliesI want to to encrypt password show me the query for encryption password
View 1 Repliesis there any way to decrypt the membership password?
View 1 RepliesI am using asp.net website , now when a user creates new account his password must be saved in hashes , or gets encrypted and submits in database , next time when he login , my application fetch password from encrypted field , then decrypt it and match with the user entered password , if that's ok , page will be redirected to some other pages ... how to do that task ??
View 1 RepliesIn the table save your credit card.I want to encrypt all credit card information to be recorded in the database.
View 2 RepliesI have an excel file with data as follows
ID Name Contact No Address
1 ABC XXXXXXX ABCNM2
XYZ xxxxxxx ASDFG
Now my requirement is read data from this excel sheet and den encrypt Contact No field for each row and den save data in database, how should it will be done I have to use some ready made available encryption algo for that.
So I'm in the process of writing an ASP.NET application that requires to import users from a PHP application. The passwords were hashed using MD5 into the database, so the user table records looks more or less like this:
user Password
user1 827ccb0eea8a706c4c34a16891f84e7b
user2 e10adc3949ba59abbe56e057f20f883e
And so on. I have access to the PHP source code and I can see that there is no salt or anything else, it is juts a straight MD5 application. Now, Back on my ASP.NET, I tried to use MD5 using the following logic:
[Code]....
Problem is, that is returning strings like 50-F8-4D-AF-3A-6D-FD-6A-9F-20-C9-F8-EF-42-89-42, which of course is not going to match with the information in the database. What should I do so I don't have to reset 500+ user passwords?
found while searching for help on my asp.net application.I have a small application with connected to a SQL database. As it was so small, and contained very little data of any importance, i had set it up with Clear passwords.Now i have been asked to expand the database considerably, and encrypted passwords are now required. I can easily modify the web.config so all future users are set up with encrypted passwords. But is there any way to change all existing users passwords to be stored encrypted?
View 10 RepliesI'm using ASP.NET membership for a site that will serve primarily sophisticated users. I understand the difference between hashed and encrypted passwords, and I'm trying to decide between the two.After my last client complained bitterly about hashed passwords being a total PITA, I've started to favor encrypted passwords. But someone suggested this just isn't secure enough.So my question is: What, exactly are the risks of encrypting passwords? Any person with the ability to steal passwords by decrypting them from the database would surely have the ability to reset them if they were hashed, no? I'm having trouble seeing where someone could cause trouble with encrypted passwords but couldn't with hashed ones. Making it convenient for users is also important.
View 4 RepliesI am trying to encrypt my passwords and store in database..i want to know which is the latest one..
View 2 RepliesI have been trying to change a users password, I have been using this code
[Code]....
I do not get an error during the try routine, but my problem comes that when the user goes it insert their new password (using login Control) it says that the password is wrong.. and they then can't login using either their new or old password.
All Password critria is met, web.config if set so passswordQuestion = false
I have an asp.net page where I have used FormsAuthentication.HashPasswordForStoringInConfigFile. Encrypted password is saved in database. I have created a forgotPassword page. Where I need to send user his password. How can I decrypt it and send it to user. if SHA1 can not be decryoted what other option should I use to encrypt the passwords?
View 5 RepliesWell, I have a website with login feature (username and password fields). . I then changed the ID and NAME attributes of the textbox. (I made sure the client Id has changed). How come? Doesn't the browser relate usernames stored in history to the ID of textbox? I'm using asp.net!
View 2 RepliesI want the login password to not be sent in plaintext (due to the risk of hijacking). I know that this can be achieved in principle using MD5 or the like, but is there a common implementation for use with Asp.Net? Of course, it's crucial that the resulting hash (?) isn't easy to decrypt. When I read various posts on this matter, some people say it's just to do a reverse on the encrypted string, so that in effect, this is totally useless.
View 6 RepliesI have to make changes to some existing web applications at work to bring them inline with a new security policy.
I am using the framework 3.5 and am using the standard sql membership provider for user authentication.
When a user is changing his password, I want to prevent him using previously used passwords. What is the best and easiest way to go about this?
I was thinking a SQL table with the following columns, my problem was do I handle encryption here as they are old?
dbo.OldUserPasswords
UserID, GUID, NOT NULL, FK Reference to aspnet_Users.
Password, nvarchar(256) NOT NULL,
Timestamp, timestamp, NOT NULL
I created a Membership login system for my client, now they do NOT want the user to use one of his 5 last passwords when it comes time to create a new one.
Is that something that is build in or how could I accomplish that?
