Thanks, this was a very important note that every body should read before installing a new dotnetnuke site

Hi Scott,

Yes, I believe that's correct. For a variety of reasons, the asp.net membership provider doesn't allow you to change the password format. 

There are some ways you can do it, but they're all things you wouldn't want to just dive right in to... To change the passwords from encrypted to hashed, you'd have to first decrypt all the passwords, then force the change in the password format field, then I think you'd have to force a reset of the password, and then lastly change it back to the user's original password. Obviously - that's a messy process. Of course, it will then be impossible to switch from hashed because users' passwords will be unrecoverable. To do that, you'd have to wait for the user to type in their password and then make the change while holding it in memory.

Shaun announced that, following this attack, they changed the DotNetNuke.com passwords to hashed - so it's certainly possible. Perhaps somebody from the team could address that... Mitchel Sellers also notes in the comments on his post that he has a module to do it - you could check with him.

Thanks,

Mike