Validate the answer to the Security Question when using hashed passwords

I have inherited an application that uses the ASP.NET membership provider for user management. As part of various fixes and enhancements I am replacing the usage of plain-text passwords with hashed ones. On the existing reset password page the user is required to enter the correct answer to their security question, their current password, their desired new password and the desired new password again.

I have run into an issue where there doesn't seem to be an easy way to verify that the entered security question answer is correct. Without this check the user can enter an开发者_JS百科ything into that field and as long as they have entered the correct current password, it will be reset.

I can't call GetPassword() as that method is unavailable if passwordFormat="Hashed" in Web.config.

I tried manually decrypting the hashed security question answer as described here but that only applies to encrypted values rather than hashed ones (logical I suppose :))

I have tried manually hashing the user-entered answer and comparing that to the value stored in the database but the two hashed strings are different. I am using the algorithm as described in the third post here and it works when comparing hashed passwords but unfortunately not for the hashed security question answer.

Does anyone have any more suggestions? This seems fairly fundamental so I have a feeling I'm missing something obvious.

---

I'm not directly answering your question about verifying the security question, but I'd like to emphasize that security questions are a very bad practice in terms of security (read "PART III: Using Secret Questions" here).

Instead, send to the user's email (which you already confirmed earlier when they registered) a "reset password link" which allows them to create a new password, assuming that they are the only ones with access to their email.

---

Bah, one cup of coffee later and the answer was obvious. I had this in my validation method:

var result = DataService.ExecuteScalar(cmd);
return result == null;

where I should have had this:

var result = DataService.ExecuteScalar(cmd);
return result != null;

It also appears that I was wrong when I thought the hashed strings for the security question answer were different.