diff --git a/src/Microsoft.AspNet.Security/DataProtection/DataProtectionHelpers.cs b/src/Microsoft.AspNet.Security/DataProtection/DataProtectionHelpers.cs
index a043bb83b9..eba80e708a 100644
--- a/src/Microsoft.AspNet.Security/DataProtection/DataProtectionHelpers.cs
+++ b/src/Microsoft.AspNet.Security/DataProtection/DataProtectionHelpers.cs
@@ -13,7 +13,8 @@ namespace Microsoft.AspNet.Security.DataProtection
         {
             if (dataProtectionProvider == null)
             {
-                dataProtectionProvider = DataProtectionProvider.CreateFromDpapi();
+                // TODO: Get this from the environment.
+                dataProtectionProvider = new EphemeralDataProtectionProvider();
             }
 
             return dataProtectionProvider.CreateProtector(string.Join(";", purposes));
diff --git a/test/Microsoft.AspNet.Security.Test/Google/GoogleMiddlewareTests.cs b/test/Microsoft.AspNet.Security.Test/Google/GoogleMiddlewareTests.cs
index 1993a56aea..c7c931067a 100644
--- a/test/Microsoft.AspNet.Security.Test/Google/GoogleMiddlewareTests.cs
+++ b/test/Microsoft.AspNet.Security.Test/Google/GoogleMiddlewareTests.cs
@@ -215,7 +215,7 @@ namespace Microsoft.AspNet.Security.Google
         [Fact]
         public async Task ReplyPathWillAuthenticateValidAuthorizeCodeAndState()
         {
-            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(DataProtectionProvider.CreateNew().CreateProtector("GoogleTest"));
+            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(new EphemeralDataProtectionProvider().CreateProtector("GoogleTest"));
             var server = CreateServer(options =>
             {
                 options.ClientId = "Test Id";
@@ -289,7 +289,7 @@ namespace Microsoft.AspNet.Security.Google
         [Fact]
         public async Task ReplyPathWillRejectIfCodeIsInvalid()
         {
-            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(DataProtectionProvider.CreateNew().CreateProtector("GoogleTest"));
+            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(new EphemeralDataProtectionProvider().CreateProtector("GoogleTest"));
             var server = CreateServer(options =>
             {
                 options.ClientId = "Test Id";
@@ -319,7 +319,7 @@ namespace Microsoft.AspNet.Security.Google
         [Fact]
         public async Task ReplyPathWillRejectIfAccessTokenIsMissing()
         {
-            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(DataProtectionProvider.CreateNew().CreateProtector("GoogleTest"));
+            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(new EphemeralDataProtectionProvider().CreateProtector("GoogleTest"));
             var server = CreateServer(options =>
             {
                 options.ClientId = "Test Id";
@@ -349,7 +349,7 @@ namespace Microsoft.AspNet.Security.Google
         [Fact]
         public async Task AuthenticatedEventCanGetRefreshToken()
         {
-            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(DataProtectionProvider.CreateNew().CreateProtector("GoogleTest"));
+            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(new EphemeralDataProtectionProvider().CreateProtector("GoogleTest"));
             var server = CreateServer(options =>
             {
                 options.ClientId = "Test Id";
diff --git a/test/Microsoft.AspNet.Security.Test/MicrosoftAccount/MicrosoftAccountMiddlewareTests.cs b/test/Microsoft.AspNet.Security.Test/MicrosoftAccount/MicrosoftAccountMiddlewareTests.cs
index d2372cc0a5..2b39e43525 100644
--- a/test/Microsoft.AspNet.Security.Test/MicrosoftAccount/MicrosoftAccountMiddlewareTests.cs
+++ b/test/Microsoft.AspNet.Security.Test/MicrosoftAccount/MicrosoftAccountMiddlewareTests.cs
@@ -84,7 +84,7 @@ namespace Microsoft.AspNet.Security.Tests.MicrosoftAccount
         [Fact]
         public async Task AuthenticatedEventCanGetRefreshToken()
         {
-            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(DataProtectionProvider.CreateNew().CreateProtector("MsftTest"));
+            ISecureDataFormat<AuthenticationProperties> stateFormat = new PropertiesDataFormat(new EphemeralDataProtectionProvider().CreateProtector("MsftTest"));
             var server = CreateServer(
                 options =>
                 {