Re:Dropbox prompts password resets
by marcosdumay on Friday August 26, 2016 @11:39AM
(#12366975)
An empty string hash does not equal the empty string (if you are on Oracle) and does certainly not equal null.
This will make it impossible for those users to login. Also, if you are luck it won't take the rest of the service down with them, making it impossible for the other users to login too.
Biologist here; so would the proper approach be
UPDATE users SET password=[generateRandomString] WHERE hashing_scheme='old';
?
No, same query but you need to make sure your authentication system disallows logging into accounts with null / empty passwords.
Except you did this while the world was on fire, late on a Friday night, after a few beers, with management screaming down the phone. And you didn't check to make sure it didn't allow anyone to log into all effected users accounts with a null/empty password. Oooops...
(Been there, done that, made similarly stupid mistakes...)