How to store forms authentication passwords in a database in a secure way?
This is one of the most seen question on the forums around the net. Forms authentication is a great way to do authentication on websites (without having annoying pop-ups to enter a username and password) and ASP.NET has great support for it. In ASP.NET v2.0 this feature will be even more interesting since the system will take care of authentication using a series of new controls (login control, registration control, login status control, etc). Back to today’s reality however. There are in fact two ways to encrypt passwords before you store these in a database: using reversible encryption or using non-reversible encryption. The latter is the best solution and is natively supported by the FormsAuthentication class in System.Web.Security. However, if users forget their password, there is no way to send their original password by using e-mail. Instead, you should have some secret question/secret answer system in there or you can use another mechanism that sends some random key to their e-m
