Confusion about Password Recovery

[news.sbcglobal.net]

If I understand correctly, by default, ASP.NET 2.0 hashes the user password
and this hashed password is unintelligible to the user (and unusable) when
it is sent by the Password Recovery control. By default, this control
resets the user's password to something random but I've never been able to
figure out how that is useful. I can't tell (by looking at the database)
what the new password is and the user certainly doesn't know what it is.
This makes no sense to me (from a usability perspective) so I'm sure I must
be missing something.

My question is, how does the user know what his/her password has been reset
to? I would prefer to send the user their password by email which means
that I have to change the way it is stored in the database and change my
site configuration to do this.

Does anyone have a link to a useful resource to help with this?

Thanks!

 

[PeterKellner]

It's the design of the PasswordRecovery control that I'm questioning. This
control's default behavior out of the box results in the password being
changed to something neither the user nor the site administrator knows.
Bottom line, the user can never log in again (without creating a new
account) and the site admin can't do anything to assist other than delete
the user's original account.

From what you say here, I think you are confusing what is happening.
The password sent to the user is not encrypted. It is just randomized
so you can login with it. The idea is so you can log in and
immediately change the password to something better.

If you don't want to send the password around email, you could always
use password question and answer to let them reset their password.

Hope this helps.
Peter Kellner
http://peterkellner.net

 

[news.sbcglobal.net]

You're right...I just took a look at the password that was sent and assumed
that the hashed password had been sent (which cannot be used to login). If
I'd looked closer I would have seen it wasn't what I thought.

Thanks for pointing this out to me...now it makes sense to me.