5 ms·

> Auth providers cant help you because the passwords are hashed... You need the same algo or you cant authenticate using the data they have. You absolutely can

> Auth providers cant help you because the passwords are hashed... You need the same algo or you cant authenticate using the data they have. You absolutely can migrate away from Auth providers. Auth0 (disclaimer: former employer) hashes passwords with Bcrypt, which is most likely the same exact algorithm you would choose. Bcrypt stores salts & rounds as part of the hash making those hashes fairly portable. Even if you wanted to change algorithms, there are ways to do this so that it is transparent to the user, such as running the plaintext password through a new algorithm after a successful authentication and storing it in a new column.

mypalmike 5y ago
He mentioned transparent migration and the problems encountered with it.
- BoorishBears 5y ago
  > Auth providers cant help you because the passwords are hashed... You need the same algo or you cant authenticate using the data they have. Seeing as you have that it becomes a non-issue
  - mypalmike 5y ago
    Perhaps I'm incorrectly assuming auth providers don't expose an API for exporting all that data. Such an API would seem to be a fairly attractive attack vector.
    - systoll 5y ago
      Auth0 and fusionAuth don’t have APIs but will process requests manually.