4 ms·
Or do the easy thing and perform a chinese fire-drill whenever the user logs in and bump them to the new encryption schema. Or invalidate and send an email.
by heretohelp 14y ago
Or do the easy thing and perform a chinese fire-drill whenever the user logs in and bump them to the new encryption schema.
Or invalidate and send an email.
- fl3tch 14y agoInterestingly, when reddit upgraded to bcrypt, they refused to do this because so many users don't know their passwords and it would lock lots of people out of their accounts forever (remember, reddit doesn't require email addresses to register). http://reddit.com/r/changelog/comments/lj0cb/reddit_change_passwords_are_now_hashed_with_bcrypt/c2t7hoa http://reddit.com/r/changelog/comments/lj0cb/reddit_change_p...
- heretohelp 14y agoGood on them for knowing their users?