Alright what I have is a website that I am rewriting for my employer, its like 95% complete now and I am wondering if I have made it secure enough. The main reason I was asked to redo the site was that it envolves bank account numbers, routing numbers, any type of address information you can think of, and up until I changed it up was using SSN's as the password. Obviously I have removed the SSN portion of the website and am prompting the user to enter/create a password and a security question to bring the site into the 20th century. I store my connection strings in the webconfig and only pull out what data is important to the user at the time Name, Address, Email, Company, excluding bank numbers and such. I store this information in Session variables for as long as the user is accessing there account. If the user does want to change the bank numbers or password, I dont actualy show them anything I just check to see if it exsists and replace it. All this is accompanied with autom ...
Go to the complete details ...