0

I have inherited an application that uses the ASP.NET membership provider for user management. As part of various fixes and enhancements I am replacing the usage of plain-text passwords with hashed ones. On the existing reset password page the user is required to enter the correct answer to their security question, their current password, their desired new password and the desired new password again.

I have run into an issue where there doesn't seem to be an easy way to verify that the entered security question answer is correct. Without this check the user can enter anything into that field and as long as they have entered the correct current password, it will be reset.

I can't call GetPassword() as that method is unavailable if passwordFormat="Hashed" in Web.config.

I tried manually decrypting the hashed security question answer as described here but that only applies to encrypted values rather than hashed ones (logical I suppose :))

I have tried manually hashing the user-entered answer and comparing that to the value stored in the database but the two hashed strings are different. I am using the algorithm as described in the third post here and it works when comparing hashed passwords but unfortunately not for the hashed security question answer.

Does anyone have any more suggestions? This seems fairly fundamental so I have a feeling I'm missing something obvious.

Malice
  • 3,809
  • 1
  • 34
  • 49

2 Answers2

1

I'm not directly answering your question about verifying the security question, but I'd like to emphasize that security questions are a very bad practice in terms of security (read "PART III: Using Secret Questions" here).

Instead, send to the user's email (which you already confirmed earlier when they registered) a "reset password link" which allows them to create a new password, assuming that they are the only ones with access to their email.

Community
  • 1
  • 1
Ofer Zelig
  • 15,893
  • 7
  • 52
  • 89
  • Ofer, you are absolutely right but we are unfortunately constrained by the time available with what we can do. Prior to this the passwords were stored in plain-text in the database and transmitted via e-mail in plain-text too so at least we have improved some aspects of the user management functionality. – Malice Aug 09 '11 at 10:44
  • You are absolutely correct, things must be done in order. I just wanted to emphasize (for the sake of all others who will come by this page) that security questions are bad practice... – Ofer Zelig Aug 09 '11 at 10:50
0

Bah, one cup of coffee later and the answer was obvious. I had this in my validation method: 

var result = DataService.ExecuteScalar(cmd);
return result == null;

where I should have had this:

var result = DataService.ExecuteScalar(cmd);
return result != null;

It also appears that I was wrong when I thought the hashed strings for the security question answer were different.

Malice
  • 3,809
  • 1
  • 34
  • 49