COC Reboot

The passwords in the COC database are not encrypted.  A few years ago, Roy and I developed a password encryption "patch" that was offered to the organizations using my code.  The COC was one organization that declined to purchase that "patch".  The perception was that, since the COC is using SSL, this is not a high risk issue.

A concern was raised a month ago from a member who noticed that the "forgot password" feature e-mails the unencrypted password to a member who has forgotten their password.  This is vulnerable to "exposing" someone's password to a hacker who knows a member's e-mail address.

We may want to consider a "fix" for this problem.  I can think of three possible scenarios:
1) Keep status-quo for now
2) Keep the passwords stored as plain text, but replace the current "forgot password" feature with a feature that allows a user to reset their password rather than e-mailing the plain text password out
3) Purchase the password encryption "patch" from Roy

Thoughts?

Option 2 would be free because I would do it.  I already have the code for it and it would be a relatively simple change.

Option 3 is more involved and not something that I'm able to take on (either free or paid).  We'll have to get costing from Roy.

I think this needs to be tabled until Roy provides an estimate so we have all of the information.

Info from Roy: 5 hours * $80 per hour + GST = $420.