I was poking around the users.xml file this weekend and decided it really bothered me that my password was stored in the clear.  If I were in a position of having my blog hosted with a web service provider this would be an especially bad thing, as I would have no idea who would have access to this file.  So I looked in CodePlex and discovered a pretty nice XML Membership provider by ArtemGB (http://artembg.com/project/xmlproviders).  Artem provides both a compiled download and full source code.

Especially handy with his provider is that you have the choice of storing the passwords in the config file encrypted or not encrypted.  Additionally, it adds support for ASP Net's built-in Password Recovery using a question and answer method. 

So after a little investigation, and an email to Mads to confirm, I decided to test this on BlogEngine.Net.   In the end everything appears to work great without any negative side effects.  If you combine this with the MyProfile extension that I recently posted you can easily change your password anytime you like.  So here's what my users.config file looks like now...

If anyone is interested in making this work on their blog feel free to contact me and I will help walk your through the steps.  Changing over should take you no more than 10 minutes.