Since I’ve started as a professional .NET web developer the first thing that gets written is the password page (After the pseudocode and specifications atleast). I’m working on a project now that uses a lot of different security techniques. We’ve put on layers and layers of security. And if we really wanted to we could make it even more secure. But all of that is wasted because the user has to be able to reset their password if they forget it. Which means that either the email or login field has to be unencrypted or easily decrypted in the database. I call this the ‘leaving the key under the garden gnome’ security.
But it will always be a compromise between security and ease of use until their is a better way to store passwords. And a better way to recover credentials if they are lost.
// My facebook habit of adding friends has stopped in its tracks until they offer another method for finding friends. Whatever happened to the email lookup that existed when it was for college alums and students. One thing I’m not doing is opening my address book for anyone.