cosi' dice Netcraft su http://news.netcraft.com/archives/2004/10/07/aspnet_security_flaw_can_bypass_password.html