I have planned to send the encrypted password from the application back to the user. I am currently using AES to encrypt user passwords.

I want to send the user's encrypted password back to them in the browser to help them with automatic logging in after a forgot password action.

Is it safe to do this?

  • 5
    What is this password for? Why do you want to pass a password to the user? Why is it encrypted instead of hashed? There are several things that need to be clarified here. – h4ckNinja Jun 20 '16 at 3:08
  • I am using cryptography rijndael for encryption. I have come across some article that this is secured encryption. So I didn't go to hashing. Is this a bad idea to choose rijndael encryption for user's password? – Jeeva Jsb Jun 20 '16 at 3:26
  • 2
    For user passwords, yes, always hash. – h4ckNinja Jun 20 '16 at 3:37
  • Oh, then I have bigger security hole in my application. Right?. Can you suggest any other c# password hashing techniques? – Jeeva Jsb Jun 20 '16 at 3:45
  • Bcrypt is an accepted hashing algorithm. But the other questions for clarification need to be answered so that I can more fully give you a response. – h4ckNinja Jun 20 '16 at 4:09

Short answer: This is extremely dangerous and must be avoided.

There are a few things here that should be changed. First, user passwords must always be hashed. As I said in the comments, bcrypt is a common and appropriate hashing mechanism.

Secondly, sending credentials back to a user leaves it open for abuse by an attacker - there is never a good reason to send this information back to the user. When a user exercises the forgot password functionality of an application, they should log back in with the new password. This removes your feature of logging the user in with their own encrypted password automatically.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.