title: How to secure user data in ASP.NET Forms Authentication
body: <p>I am making an ASP.NET website and am using <code>Forms Authentication</code>; I am using a custom provider for all the security parts (the excellent TinyProviders xml based data providers).</p>
  
  <p>Currently, the users data store (an xml file called Users.xml) contains completely unencrypted data:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;ArrayOfXmlUser xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
    &lt;XmlUser&gt;
      &lt;UserKey&gt;a34cc5b6-a0b9-4a5e-b055-951w799a8607&lt;/UserKey&gt;
      &lt;UserName&gt;Bill&lt;/UserName&gt;
      &lt;Password&gt;billspassword123&lt;/Password&gt;
      &lt;PasswordSalt /&gt;
      &lt;Email&gt;bill@contoso.com&lt;/Email&gt;
      &lt;PasswordQuestion /&gt;
      &lt;PasswordAnswer /&gt;
      &lt;CreationDate&gt;2013-03-14T21:46:36.7990912+00:00&lt;/CreationDate&gt;
      &lt;LastActivityDate&gt;2013-03-14T21:47:50.3483942+00:00&lt;/LastActivityDate&gt;
      &lt;LastLoginDate&gt;2013-03-14T21:47:50.3483942+00:00&lt;/LastLoginDate&gt;
      &lt;LastPasswordChangeDate&gt;2013-03-14T21:46:36.7990912+00:00&lt;/LastPasswordChangeDate&gt;
      &lt;LastLockoutDate&gt;9999-12-31T23:59:59.9999999&lt;/LastLockoutDate&gt;
      &lt;IsApproved&gt;true&lt;/IsApproved&gt;
      &lt;IsLockedOut&gt;false&lt;/IsLockedOut&gt;
      &lt;FailedPasswordAttemptCount&gt;0&lt;/FailedPasswordAttemptCount&gt;
    &lt;/XmlUser&gt;
  &lt;/ArrayOfXmlUser&gt;
  </code></pre>
  
  <p>How could I configure the website to do the following:</p>
  
  <ul>
  <li>Store password hashes (instead of plain text)</li>
  <li>Encrypt all (or at best the email and name) data in the users file</li>
  </ul>
  
  <p>I am looking to do this from my <code>Web.config</code> because I am using a binary distribution of TinyProvider. </p>
  
  <p>Here is my <code>Web.config</code> so far:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;authentication mode="Forms"&gt;
        &lt;forms loginUrl="~/Account/Login.aspx" timeout="2880" /&gt;
      &lt;/authentication&gt;
      &lt;profile enabled="true" defaultProvider="XmlProfileProvider"&gt;
          &lt;providers&gt;
              &lt;clear/&gt;
              &lt;add name="XmlProfileProvider"
                    applicationName="SampleWebsite"
                    type="Artem.Web.Security.XmlProfileProvider"/&gt;
          &lt;/providers&gt;
      &lt;/profile&gt;
      &lt;membership defaultProvider="XmlMembershipProvider"&gt;
            &lt;providers&gt;
                &lt;clear/&gt;
                &lt;add name="XmlMembershipProvider"
                      applicationName="SampleWebsite"
                      type="Artem.Web.Security.XmlMembershipProvider"
                      minRequiredPasswordLength="1"
                      minRequiredNonAlphanumericCharacters="0"
                      requiresQuestionAndAnswer="false"
                      requiresUniqueEmail="false"
                      passwordFormat="Clear"/&gt;
            &lt;/providers&gt;
        &lt;/membership&gt;
      &lt;roleManager enabled="true" cacheRolesInCookie="false" defaultProvider="XmlRoleProvider"&gt;
          &lt;providers&gt;
              &lt;clear/&gt;
              &lt;add name="XmlRoleProvider"
                    applicationName="SampleWebsite"
                    type="Artem.Web.Security.XmlRoleProvider"/&gt;
          &lt;/providers&gt;
      &lt;/roleManager&gt;
  </code></pre>