Mark,

DNN users (an early version of) MS membership component.

• Retrieve password can be changed by using question and answers.
• if you change default user names of admin and host, retrival will be much more difficult.
• You may continue to have the default accounts w/o specific permissions as a "honey pot"
• To prevent a brute force attack, a user is locked for some time (10 mins by default) after a number of failures (5 by default).
• you can specify minimum length of passwords and whether it needs to contain non-letter characters. 

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN

Mark,

A security review of DNN at my day-job a while back flagged the same type of information, and we were able to prove that this was not an issue with the following.

1.) Forgotten password functionality only sends the password to the user via e-mail, thus even with brute force, the user would need access to the e-mail account

2.) Forgotten passwords cannot be retreived for host level users.

---

-Mitchel Sellers
Microsoft MVP, ASPInsider, DNN MVP
CEO/Director of Development - IowaComputerGurus Inc.


Visit mitchelsellers.com for my mostly DNN Blog and support forum.

Visit IowaComputerGurus.com for free DNN Modules, DNN Performance Tips, DNN Consulting Quotes, and DNN Technical Support Services