Inside Activate
...
How To Guides
Activate Password Module Encryption
2 min
users register information with activate to enable validation and verification of the user during a password reset request stored answers the users answers are encrypted when stored in the activate database aes 256bit encryption is used and the answer is seeded with information from the user account therefore the same answer for different users does not generate the same encrypted value a random 256bit encryption key is generated for each server installation the first time it is requested the encryption key is stored in //resources/configuration/encryptionkey warning if this value is changed then all encrypted information on the server will be lost and not be accessible retrieving answers the stored answers are stored in reversible encryption hash to enable the ability for the service desk to use this information to manually verify the user this is an optional facility that can be turned off by not utilising and publishing the task in activate the users answers are not decrypted for any other operation all other operations (including checking the users answers during a reset request) the password hash is checked and not the plain text answer activate encrypted information can only be decrypted by 'trusted accounts' by default, the only trusted accounts are the activate job service account and the activate web portal application pool account (if different) trusted accounts are configured at //resources/configuration/trusted account an other user that attempts to decrypt a value in activate will get a blank result secure transmission the users answers and password are also encrypted and secured during communication with the activate password reset web service this web service is used by the activate external web portal and activate windows plugin the activate web portal is not encrypted unless ssl is installed and used the activate web portal never asks for a users final password, and the other information transmitted is the users answers the encryption key for data transferred between the clients and password reset web service has a default value that is hard coded into the clients and web service this encryption key can be changed, however, all clients and servers must have the same key or communication will be lost details on this are in the activate windows client installation guide note changing this value is not recommended