[eluser]Elliot Haughin[/eluser]
The whole process seems pretty secure... the only vulnerability is that the password stored in the database uses a 2-way encryption method, which is possible to decrypt... remove this vulnerability, and then it's properly secured.