Forgot Password encrypted email system

[DDK]

I really wish there were some examples explaining how to create a forgot
password email link system when you encrypt a password in a database and use
ASP.NET/C# preferably. Since the password is encrypted in SHA1, I can't
just send a user their password by email. So I'm not sure the best way to
accomplish a forgot password module when the password is encrypted in the
database. I've tried to find info on this but have not found anything that
really talks about this. Any help, links, or book suggestions would be
greatly appreciated.

Thanks,
d.

 

[Nicole Calinoiu]

Generate a new, random password and send that (as well as save its hash to
the db). In the e-mail, recommend that the user change their password at
first login.

HTH,
Nicole