hi, i need a requirement of asking some extra information for password reset of advanced login. the default one is either email or username. but i wanna add two more fields. any suggestions?

i am looking to check password answer that was defined during registration process.

do you have tokens for password question and answer in your registration module?

i have already enabled password question and answer in my site web.config. If i use the default dnn registration page i do see that but in advanced login registration it does not show up, and do you think i need to put a token there?

hi i have just upgraded to the newest version of advanced login. I still can't get the password question and answer token to show up in password recovery page. any ideas? i have added entry in web.config also

yes i did. below is my password recovery template

We have taken your exact template and made it work just fine on a DNN 5.6.1 test site we use. So there is no problem there.

The change to the web.config is requiresQuestionAndAnswer='true'  (changed from from 'false' to true)

We have also noticed that some version of DotNetNuke have had problems with this feature over time. So we would suggest using a late version of DNN.

Lastly... because you requested the feature, we enabled it. But I must say, the feature really "Blows Chunks" in my opinion. They have tapped into a one way encryption system written by Microsoft (naturally) that makes secure the dumb answer to a users question. Now an admin user or a host user can reset DNN user passwords, but they cannot reset the dumb answer to their Microsoft encrypted pass. Microsoft API enables a reset, but DotNetNuke has not built this feature.

This could lead to a situation where a user forgets the answer to their secret question, (perhaps how they typed it) and because neither you or they cannot reset the question answer thing, they will never be able to have that reset. That is dumb!

Even if all this is working correctly, I don't even understand how it in ANY way lends assistance to security. The assumption is that if someone has access to a users email system, then they have access to that users LIFE. So requesting that DNN sends a pass recovery to the users email address is a secure solution anyway. Call me dumb, but I fail to see how this only half way integrated solution from DNN, using yet another non standard Microsoft "half assed" attempt at security will actually help you or your users.

That little rant out of my system now... It does work the way DNN has implemented it with our module... for what it is worth.