Re:Yahoo discloses hack of 1B accounts
by _asummers on Wednesday December 14, 2016 @05:56PM
(#13180490)
Hashing the hash isn't a good idea, you're reducing the domain of your secure_hash function to the range of md5. The way to do it is to have a "password hash algo version" column and when the user puts in their password, you verify against the hash[algo](password) and rehash with the later version, changing the algo column for that user.
[ Parent
| on HN ]
You could do both though. Give much more security in the short term and upgrade anyone else who logged in later.
I did ask about the hash of hash thing some time ago and ptacek claimed that's a reasonable thing to do.
Re:Yahoo discloses hack of 1B accounts
by danielweber on Wednesday December 14, 2016 @09:35PM
(#13181900)
> you're reducing the domain of your secure_hash function to the range of md5.
Oh no, only 128 bits. The NSA will be able to brute force one of those passwords in 80 years.
Re:Yahoo discloses hack of 1B accounts
by nodamage on Thursday December 15, 2016 @02:00AM
(#13182976)
You need to do both. If you only do the latter, then stale accounts which never log in again will never have their passwords upgraded to the more secure hash. Hashing the hash allows you to replace the md5 hashes immediately, and then you can perform the upgrade if/when the user logs in again.