I also tried to use the Lost Password function. It asked me the security question, but my answer was not accepted.

Fortunately, I am logged in in another browser, so I still can login to our forum there. I wanted to change the answer to security question, but I couldn't find this section in my forum profile. Can you help me with that?

From which version did you upgrade? Did you override your old web.config?

Can you also tell me how I can change the security question and answer to it? Where can I find this user setting? Is it available at all after completing the registration?

Why did you use the full package, there is an upgrade package? I assume you override your machine key. That would be the reason why you cant login

As for the upgrade process I am using, I have been doing this from early times when I started to use YAF. Something went wrong with the upgrade first times, so I decided to do it manually using the full package. Add to this that I also fix some problems in original aspx files and do some personal settings in CSS every time before uploading the new version to the server.

Bump #2. Any chance to get answer to the following question?

the security question, answer, password and password salt are saved in the yaf_prov_Membership table but all are stored encrypted via the machine key.

BTW, when I upgrade the way I do, I never change any specific setting in the forum .config files. I imply that this machine key is something related to the web-server (server name, OS version, something else) and not a thing coded in the .config files. With that said, I simply can't change this machine key with my actions!

As for the security question, ok, I understand that they are saved in a coded form in the db. However, if I have access to my account and can change almost anything in my profile, why can't I change the security question?? I would be glad if I could overwrite it with a new question/answer pair. Is it possible?

The machine key is really important it encrypts the password, the security question and answer and also the viewstate of the page. The Install Instructions of the forums contains how to set up a machine key for the site. Do you have the old web.config before you upgrade, to check if the machine key was set in the web.config?

If the machine key was not set, I changed the hashAlgorithm for the encryption in the new web.config for new Installs. So you might need to check the membership connection string

The Password and the Security Question/Answer are all stored encrypted via the machinekey. The only way to overwrite it directly in the db is to generate a new one via the API or you create a new user with the password and Security Question/Answer and you copy over the hashed entries from that user to your user account.

I compared the recommended.web.config from the v2.2.3 and 2.2.4.4 installation packages and found this node. As I see, I have never changed its validationKey and decryptionKey attributes. The whole node is even commented out!

Where can I find this membership connection string?

Why can't we do that in the interface??

In the documenation

https://github.com/YAFNET/YAFNET/wiki/Installation 

Sorry i forgot to mention, it is also in the web.config

Yes thats a good question, i add it to my to do list

Do you want to say that I could not log in because a security algorithm has changed since the v2.2.3?

But did you change the membership connection string? you would only need to change it back then you can log in again

In the v2.2.3 installation package it was

In the v2.2.4.4 it is

I guess, this is the diff that caused the problem?