I have a question about the encryption key/keys the standard ASP.NET Membership provider uses for creating the password hashes.
Although we haven't deployed this new system we are working on yet, we might switch servers in the future. So I thought it might be a good idea to specify the encryption key/keys in the web.config file to avoid any problems with mismatched hashes if we do switch servers.
We use the standard ASP.NET Membership provider ("AspNetSqlMembershipProvider"), passwordFormat is set to "Hashed" and we use Forms authentication.
The current web.config file initially did not have any machineKey element. I used the web application and had registered and thus created an account and the hash of my password is stored in one of the aspnet_* tables.
Then I created a machineKey element in the web.config file, and specified validationKey, decryptionKey, validation and decryption attributes. I had ...
Go to the complete details ...