<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Adventures In Development &#187; Security</title>
	<atom:link href="http://www.adventuresindevelopment.com/category/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.adventuresindevelopment.com</link>
	<description>Web Development Tools, Ideas, Techniques and Resources</description>
	<lastBuildDate>Wed, 25 Jan 2012 20:41:41 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>The Importance Of Spending Time On Your Car</title>
		<link>http://www.adventuresindevelopment.com/2011/11/02/the-importance-of-spending-time-on-your-car/</link>
		<comments>http://www.adventuresindevelopment.com/2011/11/02/the-importance-of-spending-time-on-your-car/#comments</comments>
		<pubDate>Wed, 02 Nov 2011 18:11:55 +0000</pubDate>
		<dc:creator>Matthew Paulson</dc:creator>
				<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://www.adventuresindevelopment.com/?p=269</guid>
		<description><![CDATA[To some people, a car is simply a vessel for daily transportation of both people and objects. However, while this is part of what comes with car ownership, if the owner does not spend any time maintaining their car, they will run into problems. What are the benefits of spending time working on a car? &#8230; <a href="http://www.adventuresindevelopment.com/2011/11/02/the-importance-of-spending-time-on-your-car/">Continue reading</a>]]></description>
			<content:encoded><![CDATA[<p>To some people, a car is simply a vessel for daily transportation of both people and objects. However, while this is part of what comes with car ownership, if the owner does not spend any time maintaining their car, they will run into problems. What are the benefits of spending time working on a car?</p>
<p>1. The Car Can Be Sold At a Later Time</p>
<p>Although some car owners do not like to think about it, they will need to sell their car to somebody else at some point. Depending on the state of the car, they could get a lot of money or only a little; potential buyers are not going to want something that is filthy and does not run well. If the car owner has been taking care of their ride, however, they are more likely to come across success. They will not have to worry that something will go wrong.</p>
<p>2. It Will Run Well</p>
<p>Especially during the colder months of the year, a car that runs well is always something to strive for. Nobody wants to be driving down the road late at night only to find that the car is out of gas or has a flat tire. When a person chooses to pay attention to their car &#8211; for longer than it takes to drive it to work &#8211; they can hope to avoid problems. They can use their car with the confidence that they will not come across any surprise problems. <a href="http://www.comparethemarket.com/car-insurance/">Car insurance cover</a> can help if they receive issues that come with accidents.</p>
<p>3. Problems Can Be Caught Early</p>
<p>When a person chooses to look at their car or take it to an auto repair shop, they can catch problems before they become too serious. An auto shop will be able to fix any minor issues before they lead to bigger and more expensive bills for the owner; for people on a tight or otherwise limited budget, this is especially crucial. The owner can also ask questions and find personal solutions for making sure that they get the most that they can out of their car.</p>
<p>Cars, to some people, work as status symbols of their family and everything they have worked for. To other people, cars are simply something to get them from home to work, or to any other desired destination. No matter what a car is to a person, however, they need to take good care of it. An owner that spends time on their car can hope to get good money for it when they sell it in the future. They can have peace of mind that their car will not break down or require expensive fixes. By taking responsibility and using common sense, anybody can help their car last for a long time.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.adventuresindevelopment.com/2011/11/02/the-importance-of-spending-time-on-your-car/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How to Implement an ASP.NET Color Picker</title>
		<link>http://www.adventuresindevelopment.com/2009/06/12/how-to-implement-an-aspnet-color-picker/</link>
		<comments>http://www.adventuresindevelopment.com/2009/06/12/how-to-implement-an-aspnet-color-picker/#comments</comments>
		<pubDate>Fri, 12 Jun 2009 20:28:18 +0000</pubDate>
		<dc:creator>Matthew Paulson</dc:creator>
				<category><![CDATA[360 WebCMS]]></category>
		<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[C#]]></category>
		<category><![CDATA[Content Management Systems]]></category>
		<category><![CDATA[Database]]></category>
		<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Visual Basic]]></category>

		<guid isPermaLink="false">http://www.adventuresindevelopment.com/?p=139</guid>
		<description><![CDATA[One of the components of the 360 Web Content Management System (website in progress) that I wanted to develop was an events calendar that allowed you to post events into color-coded categories. You can see a demo of it here. At first, I had it so that users would manually enter in a 6-character HTML &#8230; <a href="http://www.adventuresindevelopment.com/2009/06/12/how-to-implement-an-aspnet-color-picker/">Continue reading</a>]]></description>
			<content:encoded><![CDATA[<p>One of the components of the <a href="http://www.360webcms.com/">360 Web Content Management System</a> (website in progress) that I wanted to develop was an events calendar that allowed you to post events into color-coded categories. You can see a demo of it <a href="http://cmsdemo.factor360.com/events.aspx">here</a>. At first, I had it so that users would manually enter in a 6-character HTML color code, but it was very non-intuitive for anyone who&#8217;s never worked with HTML before. Eventually I stumbled upon the <a href="http://www.karpach.com/ColorPickerDemo.aspx">ASP.NET Color Picker control</a>. It&#8217;s a custom ASP.NET control that you can add to a page much in the way that you can add a text box, radio buttons, or a drop down list.</p>
<p><span style="text-decoration: underline;"><strong>Here&#8217;s how to implement the ASP.NET Color Picker Control</strong></span></p>
<p><strong>(1) Download the library and add it to your project<br />
</strong></p>
<p>First, download the library from the ASP.NET Color Picker Control website. Make sure to download the latest binary release from the website. Currently that version is <a href="http://www.karpach.com/files/WebControls.v.1.4.10423.1-bin.zip">ASP.NET Color Picker v.1.4.10423.1 Binary</a>. Once you get the zip file, it will contain a library that you should extract to the /bin/ folder of your website.</p>
<p><strong>(2) Register the library on your page</strong></p>
<p>ASP.NET provides a set of standard controls that you can add to a page that start with the &#8220;ASP&#8221; prefix, such as &#8220;&lt;ASP:TextBox runat=&#8221;server&#8221; id=&#8221;txtBox&#8221; /&gt;. Any custom controls will have their own prefix that you specify by registering the library on the page. It&#8217;s another line of code that you add to the top of the page next to your page definition. It should look something like this:</p>
<p>&lt;%@ Register Assembly=&#8221;Karpach.WebControls&#8221; Namespace=&#8221;Karpach.WebControls&#8221; TagPrefix=&#8221;cc1&#8243; %&gt;</p>
<p><strong>(3) Add the control to your page</strong></p>
<p>Now that you have the library referenced, you can add the control to your page and make use of it.  For the purpose of this demo, I&#8217;m going to set the AutoPostBack property to true and run a function whenever the color is changed. This will show us the color that we picked inside of a label (also shown below) after we select a new color.</p>
<p>&lt;cc1:ColorPicker ID=&#8221;colorBackgroundColor&#8221; runat=&#8221;server&#8221; AutoPostBack=&#8221;true&#8221; OnColorChanged=&#8221;chngColor&#8221; /&gt;<br />
&lt;br /&gt;&lt;br /&gt;<br />
&lt;asp:Label ID=&#8221;lblResults&#8221; runat=&#8221;server&#8221; Text=&#8221;"&gt;&lt;/asp:Label&gt;</p>
<p><strong>(4) Create Your C# Function</strong></p>
<p>After we choose a color, we have to do something with it. With the ColorPicker control above, I&#8217;m using the OnColorChanged property to call the &#8220;chngColor&#8221; function, which in C# will look something like this. This will also demonstrate how to programmatically read the color chosen with the .Color property of the ASP.NET Color Picker Control</p>
<p>protected void chngColor(object sender, EventArgs e)<br />
{<br />
lblResults.Text = &#8220;&lt;div style=&#8217;background-color:#&#8221; + colorBackgroundColor.Color.Replace(&#8220;#&#8221;, &#8220;&#8221;) + &#8220;;height:50px;width:80px;text-align:center;padding-top:35px;&#8217;&gt;Sample Text&lt;/div&gt;&#8221;;<br />
}</p>
<p><strong>(5) Success</strong></p>
<p>So far, we&#8217;ve added the library to our project, registered the library on the page, added the control to the page, and done something with the color chosen by the user. Your page should look something like this:</p>
<p><a href="http://www.adventuresindevelopment.com/wp-content/uploads/2009/06/color-picker.jpg"><img class="alignnone size-full wp-image-140" title="color-picker" src="http://www.adventuresindevelopment.com/wp-content/uploads/2009/06/color-picker.jpg" alt="color-picker" width="567" height="398" /></a></p>
<p><a href="http://www.adventuresindevelopment.com/wp-content/uploads/2009/06/colorpickerdemo.zip">You can download my sample program here.</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.adventuresindevelopment.com/2009/06/12/how-to-implement-an-aspnet-color-picker/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>How to Validate Email Addresses in C#</title>
		<link>http://www.adventuresindevelopment.com/2009/06/08/how-to-validate-email-addresses-in-c/</link>
		<comments>http://www.adventuresindevelopment.com/2009/06/08/how-to-validate-email-addresses-in-c/#comments</comments>
		<pubDate>Mon, 08 Jun 2009 14:11:48 +0000</pubDate>
		<dc:creator>Matthew Paulson</dc:creator>
				<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[C#]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Visual Basic]]></category>

		<guid isPermaLink="false">http://www.adventuresindevelopment.com/?p=137</guid>
		<description><![CDATA[I was recently doing doing support for a client that had a newsletter system. The previous employee had neglected to do much in the form of format validation for email addresses from both a user-input standpoint and system-integrity standpoint. Since there were several email addresses in the database that didn&#8217;t meet the basic conventions of &#8230; <a href="http://www.adventuresindevelopment.com/2009/06/08/how-to-validate-email-addresses-in-c/">Continue reading</a>]]></description>
			<content:encoded><![CDATA[<p>I was recently doing doing support for a client that had a newsletter system. The previous employee had neglected to do much in the form of format validation for email addresses from both a user-input standpoint and system-integrity standpoint. Since there were several email addresses in the database that didn&#8217;t meet the basic conventions of an email address, the user received the following error whenever she tried to send out a message:</p>
<p><strong>Exception Details: </strong>System.FormatException: The specified string is not in the form required for an e-mail address.</p>
<p>Ouch. To remedy this issue, I added a check to make sure the email address was valid before it attempted to send the message. In the code below, I&#8217;m making use of the System.Text.RegularExpressions library that comes with the .NET framework. The code below is written in C# but the code will be very similar in Visual Basic. It will also work in ASP.NET, WPF or plain old windows forms.</p>
<p><strong>Here&#8217;s a C# function that will determine whether or not an email address is valid:</strong><br />
<code><br />
public static bool IsValidEmail(string strEmailAddress)<br />
{<br />
if (strEmailAddress == null)<br />
{<br />
return false;<br />
}<br />
else<br />
{<br />
return System.Text.RegularExpressions.Regex.IsMatch(strEmailAddress, @"^[-a-zA-Z0-9][-.a-zA-Z0-9]*@[-.a-zA-Z0-9]+(\.[-.a-zA-Z0-9]+)*\.(com|edu|info|gov|int|mil|net|org|biz|name|museum|coop|aero|pro|[a-zA-Z]{2})$", RegexOptions.IgnorePatternWhitespace);<br />
}<br />
}<br />
</code></p>
<p>I also made some modifications to the system on the front-end, so when a user registered from then on, that it would validate that they have entered an email address and that the email address matched the format of an email address using a RequiredFieldValidator and a RegularExpressionValidator.&lt;&#8211;&gt;</p>
]]></content:encoded>
			<wfw:commentRss>http://www.adventuresindevelopment.com/2009/06/08/how-to-validate-email-addresses-in-c/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Hash Passwords in C# and Visual Basic Using SHA-512</title>
		<link>http://www.adventuresindevelopment.com/2009/06/02/hash-passwords-in-c-and-visual-basic-using-sha-512/</link>
		<comments>http://www.adventuresindevelopment.com/2009/06/02/hash-passwords-in-c-and-visual-basic-using-sha-512/#comments</comments>
		<pubDate>Tue, 02 Jun 2009 20:26:31 +0000</pubDate>
		<dc:creator>Matthew Paulson</dc:creator>
				<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[C#]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Visual Basic]]></category>

		<guid isPermaLink="false">http://www.adventuresindevelopment.com/?p=126</guid>
		<description><![CDATA[We recently covered an easy way to hash passwords using SHA-1 in .NET using either Visual Basic or C#. In most cases, SHA-1 encryption is &#8220;secure enough&#8221;, but there are some mathematical weaknesses. Microsoft&#8217;s .NET platform (specifically the System.Security class) allows you to encrypt passwords with a number of differnet algorithms without having to know the &#8230; <a href="http://www.adventuresindevelopment.com/2009/06/02/hash-passwords-in-c-and-visual-basic-using-sha-512/">Continue reading</a>]]></description>
			<content:encoded><![CDATA[<p>We recently covered an <a href="http://www.adventuresindevelopment.com/2009/05/23/a-simple-way-to-hash-passwords-in-aspnet/">easy way to hash passwords using SHA-1</a> in .NET using either Visual Basic or C#. In most cases, SHA-1 encryption is &#8220;secure enough&#8221;, but there are some <a href="http://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html">mathematical weaknesses</a>. Microsoft&#8217;s .NET platform (specifically the System.Security class) allows you to encrypt passwords with a number of differnet algorithms without having to know the mathematics behind them.</p>
<p>Today, we&#8217;re going to encrypt a string with SHA-2, specifically the SHA-512 derivation of SHA-2, which should hypothetically be more secure than SHA-1 because it has a longer message digest than SHA-1. The example code I&#8217;m going to show off today also uses a &#8220;<a href="http://en.wikipedia.org/wiki/Salt_(cryptography)">salt</a>&#8220;, whereas the previous function I showed off didn&#8217;t. This will make your hashed-passwords more immume to dictionary attacts because not only would the hacker have to develop a hash for every commonly known password, but as well as every commonly known password multiplied by the nearly infinite number of possible salts.</p>
<p><strong>Here&#8217;s the function:</strong></p>
<p>    public static string CreateSHAHash(string Password, string Salt)<br />
    {<br />
        System.Security.Cryptography.SHA512Managed HashTool = new System.Security.Cryptography.SHA512Managed();<br />
        Byte[] PasswordAsByte = System.Text.Encoding.UTF8.GetBytes(string.Concat(Password, Salt));<br />
        Byte[] EncryptedBytes = HashTool.ComputeHash(PasswordAsByte);<br />
        HashTool.Clear();<br />
        return Convert.ToBase64String(EncryptedBytes);<br />
    }</p>
<p><strong>How it works:</strong></p>
<p>This method makes use of the System.Security.Cryptography class. It combines your password and the salt that you provide and  turns it into a byte-array. It runs those bytes through the has computation function provided by the class and returns an 88-bit string of the message-digest/hash that&#8217;s created.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.adventuresindevelopment.com/2009/06/02/hash-passwords-in-c-and-visual-basic-using-sha-512/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>How to Authenticate a User in Active Directory using ASP.NET</title>
		<link>http://www.adventuresindevelopment.com/2009/06/02/how-to-authenticate-a-user-in-active-directory-using-aspnet/</link>
		<comments>http://www.adventuresindevelopment.com/2009/06/02/how-to-authenticate-a-user-in-active-directory-using-aspnet/#comments</comments>
		<pubDate>Tue, 02 Jun 2009 15:58:41 +0000</pubDate>
		<dc:creator>Matthew Paulson</dc:creator>
				<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[C#]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Visual Basic]]></category>

		<guid isPermaLink="false">http://www.adventuresindevelopment.com/?p=123</guid>
		<description><![CDATA[If you&#8217;re working in an academic or large corporate or government setting, changes are you&#8217;re going to have a network in place using Active Directory or an open-source equivalent. Every user in the organization will have some sort of an account to use. If you&#8217;re building an internal web-application or desktop-application, it doesn&#8217;t make a &#8230; <a href="http://www.adventuresindevelopment.com/2009/06/02/how-to-authenticate-a-user-in-active-directory-using-aspnet/">Continue reading</a>]]></description>
			<content:encoded><![CDATA[<p>If you&#8217;re working in an academic or large corporate or government setting, changes are you&#8217;re going to have a network in place using Active Directory or an open-source equivalent. Every user in the organization will have some sort of an account to use. If you&#8217;re building an internal web-application or desktop-application, it doesn&#8217;t make a lot of sense to give the user another set of credentials. Instead, you can validate users by checking the permissions existing Active Directory accounts.</p>
<p>The source code to check a user&#8217;s credentials in Active Directory using C# or Visual Basic is actually fairly minimal. This works with both ASP.NET and with Windows Forms  (or WPF for that matter) if you&#8217;re building a desktop application.</p>
<p><span style="text-decoration: underline;"><strong>Here&#8217;s how to do it:</strong></span></p>
<p><strong>(1) Reference the appropriate library</strong></p>
<p>You&#8217;ll need to make use of the System.DirectoryServices library that comes with Visual Studio. You can add this to your ASP.NET code-behind page or your C# class for your Windows forms like this.</p>
<p><em>using System.DirectoryServices;</em></p>
<p><strong>(2) Create</strong><em> <strong>An Authentication Function.</strong></em></p>
<p>Here&#8217;s a basic function that will check a user&#8217;s permissions on a given domain. Essentially, it will try to create an Active Directory entry using the provided credentials, and it can successfully create a valid entry, we know that the user is authenticated. Otherwise, it&#8217;ll return false.</p>
<p>public bool AuthenticateActiveDirectory(string Domain, string UserName, string Password)<br />
{<br />
try<br />
{<br />
DirectoryEntry entry = new DirectoryEntry(&#8220;LDAP://&#8221; + Domain, UserName, Password);<br />
object nativeObject = entry.NativeObject;<br />
return true;<br />
}<br />
catch (DirectoryServicesCOMException) { return false; }<br />
}</p>
<p>That&#8217;s really all there is to it. Microsoft has an <a href="http://msdn.microsoft.com/en-us/library/ms180890(VS.80).aspx" target="_blank">extensive aritcle</a> on MSDN that covers active directory authentication in .NET that you might want to check out as well.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.adventuresindevelopment.com/2009/06/02/how-to-authenticate-a-user-in-active-directory-using-aspnet/feed/</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>How to Generate Random Passwords in C#</title>
		<link>http://www.adventuresindevelopment.com/2009/05/26/how-to-generate-random-passwords-in-c/</link>
		<comments>http://www.adventuresindevelopment.com/2009/05/26/how-to-generate-random-passwords-in-c/#comments</comments>
		<pubDate>Tue, 26 May 2009 14:22:35 +0000</pubDate>
		<dc:creator>Matthew Paulson</dc:creator>
				<category><![CDATA[C#]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://www.adventuresindevelopment.com/?p=96</guid>
		<description><![CDATA[If you&#8217;re developing a site that requires users to logon, chances are you&#8217;re going to need to be able to generate passwords at some point, whether it be when users initially create their accounts or after they lose their passwords and need to reset their account credentials. Here&#8217;s a very customizable function that will generate &#8230; <a href="http://www.adventuresindevelopment.com/2009/05/26/how-to-generate-random-passwords-in-c/">Continue reading</a>]]></description>
			<content:encoded><![CDATA[<p>If you&#8217;re developing a site that requires users to logon, chances are you&#8217;re going to need to be able to generate passwords at some point, whether it be when users initially create their accounts or after they lose their passwords and need to reset their account credentials.</p>
<p><strong>Here&#8217;s a very customizable function that will generate a pseudo-random password for you in C#</strong></p>
<p><code>public static string GenerateRandomPassword(int Length)<br />
{<br />
char[] ValidCharacters = "abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ".ToCharArray();<br />
string password = string.Empty;<br />
Random RndGenerator = new Random();<br />
for (int i = 0; i &lt; Length; i++)<br />
{<br />
int x = RndGenerator.Next(1, ValidCharacters.Length);<br />
if (!password.Contains(ValidCharacters.GetValue(x).ToString()))<br />
{<br />
password += ValidCharacters.GetValue(x);<br />
}<br />
else<br />
{<br />
i--;<br />
}<br />
}<br />
return password;<br />
}<br />
</code></p>
<p>There&#8217;s some really neat stuff going on in this function.  You can specify which characters you would like to choose from as your random choices. It&#8217;s definitely better to have a longer array of choices, so if you&#8217;re comfortable putting in special characters like !, @, #, $, %, ^, &amp;, or *, that will make it much harder for your passwords to be brute-forced or hacked otherwise.  The above function also makes sure that the same character isn&#8217;t used twice for additional security. You can take out the if-else statement if you&#8217;re not concerned about that.</p>
<p>To make use of the function, you can just call it up, specify the length of the password you would like to create and it will return a string that contains a random password of that length.</p>
<p>Happy Developing!</p>
]]></content:encoded>
			<wfw:commentRss>http://www.adventuresindevelopment.com/2009/05/26/how-to-generate-random-passwords-in-c/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>A Simple Way to Hash Passwords in ASP.NET</title>
		<link>http://www.adventuresindevelopment.com/2009/05/23/a-simple-way-to-hash-passwords-in-aspnet/</link>
		<comments>http://www.adventuresindevelopment.com/2009/05/23/a-simple-way-to-hash-passwords-in-aspnet/#comments</comments>
		<pubDate>Sat, 23 May 2009 15:17:35 +0000</pubDate>
		<dc:creator>Matthew Paulson</dc:creator>
				<category><![CDATA[ASP.NET]]></category>
		<category><![CDATA[C#]]></category>
		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://www.adventuresindevelopment.com/?p=83</guid>
		<description><![CDATA[If you&#8217;re developing a website that requires your users to create an account, it&#8217;s a very good idea to not store their passwords in plain-text in the database. A good chunk of users use the same password for just about everything, so if your database is compromised, there&#8217;s the possibility of having some real reprocussions &#8230; <a href="http://www.adventuresindevelopment.com/2009/05/23/a-simple-way-to-hash-passwords-in-aspnet/">Continue reading</a>]]></description>
			<content:encoded><![CDATA[<p>If you&#8217;re developing a website that requires your users to create an account, it&#8217;s a very good idea to not store their passwords in plain-text in the database. A good chunk of users use the same password for just about everything, so if your database is compromised, there&#8217;s the possibility of having some real reprocussions for your users. Fortunately, it&#8217;s very easy to hash passwords in ASP.NET (and C# and Visual Basic in general).</p>
<p>Microsoft has provided us with a method called <a href="http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.hashpasswordforstoringinconfigfile.aspx">FormsAuthentication.HashPasswordForStoringInConfigFile</a> that will hash your user&#8217;s passwords with <a href="http://en.wikipedia.org/wiki/MD5">MD5</a> or <a href="http://en.wikipedia.org/wiki/SHA_hash_functions">SHA-1</a> with a single line of code. Given the choice, I&#8217;d recommend SHA-1 because it&#8217;s generally considered more secure by the security community.</p>
<p><strong>So what&#8217;s password hashing anyway?</strong></p>
<p>Essentially, a hash function provides a means to take a string of text that you want to protect and encrypts it in such a manner that if the original text were ran through the function again, it would always generate the same result. Hash functions are generally a &#8220;one-way&#8221; encryption, so you can take the original password and turn it into the hashed password, but you can&#8217;t go back from the hashed password and turn it back into the original.</p>
<p>If you&#8217;d like a more technical explanation of password hashing, checkout this article on <a href="http://mathworld.wolfram.com/HashFunction.html">MathWorld</a>.</p>
<p><strong>Using the Function:</strong></p>
<p>public static string PasswordHasher(string Password)<br />
{<br />
return FormsAuthentication.HashPasswordForStoringInConfigFile(Password, System.Web.Configuration.FormsAuthPasswordFormat.SHA1);<br />
}</p>
<p>The above method will take a password that you enter and run it through the encryption function provided using the SHA1 format. You&#8217;ll get back a string with the generated hash of your password.</p>
<p>Overall, it&#8217;s a very nice quick and dirty way to hash a password in ASP.NET, <a href="http://blog.veggerby.dk/2008/07/06/abuse-of-formsauthenticationhashpasswordforstoringinconfigfile-method/">although some might criticize its use</a>. If you would like to at a SALT to your password, <a href="http://www.aspnextgen.com/Tutorial/77D4AFDC-585D-4539-A364-30028327FF14.dcik">read this article at donetjunkies</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.adventuresindevelopment.com/2009/05/23/a-simple-way-to-hash-passwords-in-aspnet/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>
<!-- WP Super Cache is installed but broken. The path to wp-cache-phase1.php in wp-content/advanced-cache.php must be fixed! -->
