Hi,

I was very discouraged to test out the password reminder capability of DNN and see that the system emailed me my password.  Emailing me my password is not quite the same as emailing me a password "reminder". 

This is a very serious security issue - users are not informed that their passwords are stored in an unencryptable form when they sign up for a DNN account on your portal.    They are not informed at the time of signup that the portal can send them their actual password by email if they forget it, and they should be.   A user may not like having their own moderately secure password sent to them in their email box, where sometimes they aren't even able to delete the traces of it.

By emailing the user their password, anytime I see someone in any WLAN public location (not connected via VPN)  that I know is using a DNN web portal in their company, I can connect to their DNN site, have their server send them a "Password Reminder", wait for their email to check, and snoop their password.

To make matters even worse, users should be aware that use of the single signon module also exposes those passwords as well - this means that if you are using single signon with windows authentication and are a network administrator and connected even internally via WLAN on your laptop not through VPN and have your email open, anyone in your company that can also connect to your WLAN can easily steal your network administration password.

My suspicion is that most DNN users are not aware of the fact that just having their email client open and checking email on any WLAN not over VPN provides a means for unauthorized password snooping.  And when I forgot my password on this site, I was very displeased to see that my password was sent over plaintext to my own email account when I couldn't remember which password I was using. I had used a variant of my own "medium security" password for access to this forum and portal.

Here is a more industry standard approach:

http://www.dotnetnuke.com/Community/Forums/tabid/795/forumid/118/threadid/35249/scope/posts/Default.aspx

Blessings,

Mike

Hi Mike,

These options are configurable through the provider declaration in your web.config (at configuration/system.web/membership/providers).  For example, the AspNetSqlMembershipProvider supports passwordformat="Hashed", which I always encourage.  If you wish to disable password retreival, add an enablePasswordRetreival="false" to your provider element.  I always recommend hashing passwords and using the requiresQuestionAndAnswer="true".

DNN supports all of these scenarios, allowing a host to set requirements according to the information being protected.  If you're unhappy with these options, you can always plug in a provider and roll your own security.  I almost universally discourage this; it will almost certainly be less secure than the default provider.

I believe this addresses all of your concerns.

Brandon