0

Im using an asp.net mvc 3 project. I want to be able to email a users password to them if they submit their username in RecoverPassword page.

How can i do that?

Thanks

raklos
  • 28,027
  • 60
  • 183
  • 301

2 Answers2

2

Its best to store the password in your database as a hash so it can never be reversed. If they forget their password, best thing to do is let them reset it, rather than telling them what the old one is.

Telanor
  • 4,419
  • 6
  • 29
  • 36
  • this would require them to have a secret question/answer right? I want to avoid them needing to enter secret Q/A. – raklos Dec 24 '10 at 20:01
  • Not necessarily. You can make it as simple as entering their username into a form, which then fetches their saved email and emails them a link. They click the link, containing a unique ID, which brings them to a page where they enter a new password. – Telanor Dec 24 '10 at 20:13
1

Don't do that. Storing passwords in plain text is insecure.

John Farrell
  • 24,673
  • 10
  • 77
  • 110
  • would i be able to store it encrypted but send it decrypted in the email? – raklos Dec 24 '10 at 19:30
  • 1
    @raklos: No. Firstly, email is (generally) insecure. Secondly, if you can decrypt it, that means you're storing the key somewhere, likely in the same place you're storing the encrypted passwords. Passwords should always be one-way hashed, never encrypted. – Andrew Coleson Dec 24 '10 at 19:53