5 ms·
sigh - this happens just as I completed moving my web app to bcrypt and once enough time has passed for most of the passwords to be converted from my old salted
by pilif 15y ago
sigh - this happens just as I completed moving my web app to bcrypt and once enough time has passed for most of the passwords to be converted from my old salted-md5 method.
Most of the users are German or French speaking, so I'm sure there will be 8bit characters. I wonder whether just forcing them to use the forgot-my-password function is good enough or whether I will have to do extra work.
Still. Very detailed email and very helpful thread.
- dekz 15y agoSpend x weeks updating passwords as the users log in, then for whoever hasn't logged in since then can be sent an email (maybe it doesn't have to exactly say "Login so I can update the passwords", just some sort of incentive to log in.
- tedunangst 15y agoThis depends entirely on what bcrypt implementation you use. The ruby gem for instance uses a version that's not affected (bcrypt.c from openbsd).