Re:Passwords for 32M Twitter accounts may have been hacked a...
by merb on Thursday June 09, 2016 @03:28AM
(#11868049)
eventually at least on PBKDF2 you could also increase the number of rounds taken.
So if somebody logs in you could recalculate the PBKDF2 hash.
[ Parent
| on HN ]
Re:Passwords for 32M Twitter accounts may have been hacked a...
by DasIch on Thursday June 09, 2016 @08:10AM
(#11868819)
You can upgrade hashes offline as well. You just hash the existing hash with the new algorithm/configuration and remember algorithm, salt and any other parameters for all previously used algorithms. If you have all that information you can take the same path to verify the password and replace the chained hash with a simple hash that's faster to calculate.
Re:Passwords for 32M Twitter accounts may have been hacked a...
by drrob on Thursday June 09, 2016 @07:58AM
(#11868785)
Indeed, though I suppose you've got to hope that the keeper of the passwords gets their hands on a similar level of processing power as the attackers do, with which they can increase the encryption work factor.