1

I have planned to send the encrypted password from the application back to the user. I am currently using AES to encrypt user passwords.

I want to send the user's encrypted password back to them in the browser to help them with automatic logging in after a forgot password action.

Is it safe to do this?

Improve this question
7
  • 5
    What is this password for? Why do you want to pass a password to the user? Why is it encrypted instead of hashed? There are several things that need to be clarified here.
    – h4ckNinja
    Jun 20, 2016 at 3:08
  • I am using cryptography rijndael for encryption. I have come across some article that this is secured encryption. So I didn't go to hashing. Is this a bad idea to choose rijndael encryption for user's password?
    – Jeeva Jsb
    Jun 20, 2016 at 3:26
  • 2
    For user passwords, yes, always hash.
    – h4ckNinja
    Jun 20, 2016 at 3:37
  • Oh, then I have bigger security hole in my application. Right?. Can you suggest any other c# password hashing techniques?
    – Jeeva Jsb
    Jun 20, 2016 at 3:45
  • Bcrypt is an accepted hashing algorithm. But the other questions for clarification need to be answered so that I can more fully give you a response.
    – h4ckNinja
    Jun 20, 2016 at 4:09

1 Answer 1

Reset to default
8

Short answer: This is extremely dangerous and must be avoided.

There are a few things here that should be changed. First, user passwords must always be hashed. As I said in the comments, bcrypt is a common and appropriate hashing mechanism.

Secondly, sending credentials back to a user leaves it open for abuse by an attacker - there is never a good reason to send this information back to the user. When a user exercises the forgot password functionality of an application, they should log back in with the new password. This removes your feature of logging the user in with their own encrypted password automatically.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .