Hello,

Users create account using membership control,and passwords are Hashed. I'm using passwordrecovery control to reset the user password if they forgot it by asking them for email.

The problem is that if I know someone's email, I can rest their password. I want the passwordrecovery to send an email with a link to the user. And when the user clicks on the link the password changed. I don't want to use the secret question method. Any help???

Thank you

Hello,

The password recovery wizard also asks you to provide the secret answer for the question you provided during user creation.

So just knowing the email wont work for recovering password, and so it's quite safe.