3 ms·
You could add a second password column to your users. Then if that column is empty, authenticate against the old password. If it passes, hash the password (just
by pilif 13y ago
You could add a second password column to your users. Then if that column is empty, authenticate against the old password. If it passes, hash the password (just supplied by the user) with bcrypt and store it in the new column.
Over time, active users get their password upgraded.
Then after a longer time, just reset the passwords of the users who never logged in since you started migrating.
- byroot 13y agoYou can even do simpler. On signup store: $password = password_hash(md5($password),PASSWORD_BCRYPT); And on login: password_verify(md5($password), $password_hash); Then you just have apply password_hash() on all you passwords in database. Bonus the migration is instantaneous, you don't need a 6 month transition period. IMHO it do not reduce the security, but i'm not a crypto expert though.
- Jeremy1026 13y agoIt does add extra computational power to your log in though. While it is a minimal amount, depending on the size of your application it could be notable.
- byroot 13y agoThere is no way that it become notable. bcrypt is precisely designed to be slow and greedy in computational power. So adding an extra md5 hashing is totally insignificant (in term of computation).