3 ms·

So migrate? Hash the hashes with Bcrypt or PBKDF2. Bcrypt(MD5(password)) is just as effective as Bcrypt(password) at knocking brute force attempts on the head.

• finnw 13y ago
  Unless the Bad Guys already have the MD5 hashes
  • Xylakant 13y ago
    Then the problem is not "I support an app that uses md5 hashes" any more. Your problem in that case is "all my users accounts were broken."
  • nly 13y ago
    Right, but you can still perform the migration I suggested and flag accounts for a password reset on next login.