A well known CMS called Joomla allows users to register and the password appears hidden as you register with dots a normal experience online - at this point you think just you know it. But if the site is using http then in fact the password is POSTed using plaintext.

This shouldn't be allowed!

I can understand that passwords are stored as salted hashes in good systems so even if the passwords are discovered on the db you cant use them to login.

Is that pretty much it? 

Before we talk about password reset - in this case a good system cannot remind you of your password as it is not recoverable! It can only reset it for you and again isn't this sent plaintext over the net ??? So why cant that get stolen..

The issue is when the real plain text passwords are known by anyone or any system other than the user then identity is lost. 


Question: Keyword not supported in SQL Server CE connection string
Answer: I think you're just simply missing an = sign:

Data Source=|DataDirectory|\MyData.sdf; Persist Security Info=False;
           * 
          ***