3 ms·
That's a waste of resources, because each subsequent time a user logs in you have to hash the password twice with two different hashing schemes to verify their
by Svenskunganka 10y ago
That's a waste of resources, because each subsequent time a user logs in you have to hash the password twice with two different hashing schemes to verify their password.
The normal way of doing this is when the next time the user logs in, you use the old hashing scheme to check that the passwords match, if they do, you hash the password with the new hashing scheme and overwrite the old one with the new one. This is often coupled with invalidating all session tokens to force all users to login again (in order to speed up the process of migrating active users to the new hashing scheme).
The problem comes with the users that hasn't logged in for years, they still have their password hashed with the old scheme, but normally you would invalidate those hashes. That means getting rid of them completely so if a data breach would occur, their accounts doesn't have any hashes that could be attacked (UPDATE users SET password=null WHERE hashing_scheme='old'). From the users perspective, this would force them to reset (it's actually set now, not reset) their password via their email.
- medmunds 10y ago> each subsequent time a user logs in you have to hash the password twice with two different hashing schemes The first time such a user logs in, you can upgrade their hash to the latest scheme, so there's no extra work on later logins. Django, e.g., does just this, automatically. https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#password-upgrading https://docs.djangoproject.com/en/1.10/topics/auth/passwords...
- Svenskunganka 10y agoThat's exactly what I was implying...
- medmunds 10y agoSorry, I was trying to point out that you can have it both ways. As pixelcort suggested, do a one-time upgrade of all (weak) hashes to newScheme(oldScheme(password). But then as users login, you can upgrade them to just newScheme(password). No need to force a reset just because people haven't logged in recently. I'm familiar with Django, and they happen to have some nice docs on both parts of the process: bulk upgrade to stronger scheme by wrapping [1] and individual upgrade on login [2]. But the technique isn't unique to Django. [1]: https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#password-upgrading-without-requiring-a-login https://docs.djangoproject.com/en/1.10/topics/auth/passwords... [2]: https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#password-upgrading https://docs.djangoproject.com/en/1.10/topics/auth/passwords...
- Svenskunganka 10y agoAlright, I understand now. A bit hard to figure that out from your original comment though, but thank you for clarifying! I'm curious about using two different algorithms for hashing at the same time would affect entropy. It could be that the original plain-text password has better entropy than the SHA1 hash (if that was your old hashing scheme) of the original password has.
- StavrosK 10y agoIt might, but nobody is going to discover your password by brute-forcing the SHA1 digest result.
- bigiain 10y ago> (UPDATE users SET password=null WHERE hashing_scheme='old') Except you did this while the world was on fire, late on a Friday night, after a few beers, with management screaming down the phone. And you didn't check to make sure it didn't allow anyone to log into all effected users accounts with a null/empty password. Oooops... (Been there, done that, made similarly stupid mistakes...)
- deleted 10y ago[deleted]
- Grangar 10y agoWow, ouch.
- jonlucc 10y agoBiologist here; so would the proper approach be UPDATE users SET password=[generateRandomString] WHERE hashing_scheme='old'; ?
- anujanpan 10y agoNo, same query but you need to make sure your authentication system disallows logging into accounts with null / empty passwords.
- marcosdumay 10y agoAn empty string hash does not equal the empty string (if you are on Oracle) and does certainly not equal null. This will make it impossible for those users to login. Also, if you are luck it won't take the rest of the service down with them, making it impossible for the other users to login too.
- Dylan16807 10y agoWaste of resources? If you're upgrading hashes, the new one should be nice and slow anyway. It doesn't matter if you end up doing an extra 1% work.