4 ms·
You can even do simpler. On signup store: $password = password_hash(md5($password),PASSWORD_BCRYPT); And on login: password_verify(md5($password), $pass
by byroot 13y ago
You can even do simpler.
On signup store:
$password = password_hash(md5($password),PASSWORD_BCRYPT);
And on login:
password_verify(md5($password), $password_hash);
Then you just have apply password_hash() on all you passwords in database.
Bonus the migration is instantaneous, you don't need a 6 month transition period.
IMHO it do not reduce the security, but i'm not a crypto expert though.
- Jeremy1026 13y agoIt does add extra computational power to your log in though. While it is a minimal amount, depending on the size of your application it could be notable.
- byroot 13y agoThere is no way that it become notable. bcrypt is precisely designed to be slow and greedy in computational power. So adding an extra md5 hashing is totally insignificant (in term of computation).