I've been extending the module originally created by Mitchell Sellers (http://www.iowacomputergurus.com/free-products/dotnetnuke-modules/secure-password-recovery.aspx) and plan to release it as a free extension to Michell's module (with is permission). It expands on the original by adding capthca for the passwrod recovery as well as a "spoof proof" guid based email link and the ability to resolve multiple accounts using the same email address.

I need to finish up a few details and have our security partner scan it for any know or open brute force, information leakage and anti-automation vulns.

---

Steven Webster
Manager, Community Platform
F5 Networks, DevCentral

Thanks Steven - I'll check that out.

Maybe it's just me though, but I feel like this situation could be tremendously improved with two pretty simple moves.

First, DNN should ALWAYS default to "Hashed" instead of "Encrypted" passwords. If somebody wants to use Encrypted passwords, cool, but I just don't think it should ever be the default.

Second, they should add a line to the password reset procedure that marks the user for forcing a password change on login. I put a request in gemini on this a while back and never heard anything on it... then I realized that a bunch of other basically identical requests were put in and those were ignored too. The thing is that DNN will reset a users' password to a random string and email them their new temporary password, but, it doesn't force them to change the password on login... which is nuts for like 10 different basic reasons.

Anyway - that'd be my thought on it...

Mike