4 ms·
If you happen to have a web app that stores passwords in clear text or SHA-1 hashed, all is not lost. You can apply further secure hashes to the existing value
by teyc 14y ago
If you happen to have a web app that stores passwords in clear text or SHA-1 hashed, all is not lost. You can apply further secure hashes to the existing value stored on db and update your authentication validator.
- heretohelp 14y agoOr do the easy thing and perform a chinese fire-drill whenever the user logs in and bump them to the new encryption schema. Or invalidate and send an email.
- fl3tch 14y agoInterestingly, when reddit upgraded to bcrypt, they refused to do this because so many users don't know their passwords and it would lock lots of people out of their accounts forever (remember, reddit doesn't require email addresses to register). http://reddit.com/r/changelog/comments/lj0cb/reddit_change_passwords_are_now_hashed_with_bcrypt/c2t7hoa http://reddit.com/r/changelog/comments/lj0cb/reddit_change_p...
- heretohelp 14y agoGood on them for knowing their users?