3 ms·
Hashing the hash isn't a good idea, you're reducing the domain of your secure_hash function to the range of md5. The way to do it is to have a "password hash al
by _asummers 10y ago
Hashing the hash isn't a good idea, you're reducing the domain of your secure_hash function to the range of md5. The way to do it is to have a "password hash algo version" column and when the user puts in their password, you verify against the hash[algo](password) and rehash with the later version, changing the algo column for that user.
- aidos 10y agoYou could do both though. Give much more security in the short term and upgrade anyone else who logged in later. I did ask about the hash of hash thing some time ago and ptacek claimed that's a reasonable thing to do.
- danielweber 10y ago> you're reducing the domain of your secure_hash function to the range of md5. Oh no, only 128 bits. The NSA will be able to brute force one of those passwords in 80 years.
- nodamage 10y agoYou need to do both. If you only do the latter, then stale accounts which never log in again will never have their passwords upgraded to the more secure hash. Hashing the hash allows you to replace the md5 hashes immediately, and then you can perform the upgrade if/when the user logs in again.