No takers till now. So let me rephrase it a bit :

My DNN site never got thru internal audit. One reason cited for this was that the password was sent in clear text. I know I'll be better off with SSL, but I'm just worried about the scenario where my host might not enable or even allow SSL support. So, what I'd like to know is how to configure the AspNetSqlMembershipProvider not just to store the password in the database in hashed or encrypted form, but also to encrypt or hash the password sent over the wire when SSL is not enabled. More specifically, what client-side JavaScript needs to be written to mask (or even hide the password being transmitted) and I suppose this JS function also needs to match the storage format for the password on the server, i.e., Hashed (SHA1), or Encrypted (Triple-DES) and what .vb file has to be modified to call this JavaScript function? In fact, I'm surprised why this kind of thing was never included with DotNetNuke in the first place, it would have made life for newbies like me a lot more pleasant. In fact, even client-side validation for a number of core modules in DNN seems to be lacking which is another reason why my DNN site was unable to get thru internal security audit. I hope someone will now be willing to offer some tips.

Thank you, Sebastian.

In this connection, I would like to know whether Windows Live authentication would solve my problem as it looks like you can login only if you have associated a Windows LiveID with your User Account and the secret key and Application ID seem to be the key mechanisms to thwart off any eavesdropping attacks based on the clear text password currently being transmitted.