I was a little surprised today to realize that when a user registers for a DotNetNuke portal, the system automatically emails them their password. Correct me if I'm wrong, but that seems totally nuts. What's the point of using SSL on a site if you are going to send a person's password to them in plain text to what might very well be a totally insecure email system?

Also, I was further surprised to realize that the "password reminder" link actually emails the persons' password! That must mean that passwords are reversible from their stored values in the database right?

Is there any way to securely store passwords? - from both the users themselves and those with db access?

Hello,

Thanks for your quick response.

I realized that last night and switched the web.config file to disable password retrieval and use hashed passwords. It was also a little annoying, but I edited the emails in the language settings to remove the password from being emailed when a person registers.

Still, this is a little disappointing. I can't really understand why dotnetnuke would use such bad default settings. Most users presumably don't take the time to update those settings - including the admins of this site. To me, that just means there's 600,000 some sites out there with bad password practices. I found a decent post on it here:

http://www.iowacomputergurus.com/blog/13/securing-user-passwords-in-dotnetnuke.aspx

Is there something in the design of DNN that makes using encrypted passwords smarter or something?

Thanks,

Mike

We struck the same issue. We wanted to make things a bit more user friendly and enable people with lost or forgotten passwords to have some options, so we have built a password resetter module.

The module using the 'Forgot Password' function to send a link via email to the user allowing them to rest their password. The reset link is only valid for a duration set by the admin. This means passwords are never seen in clear text, as a user cannot retrieve an existing password, yet it's easy for them to set up a new one.

The module is for v5 and up. You can find it on Snowcovered by searching 'password resetter'.