Re:Yahoo discloses hack of 1B accounts
by danielweber on Wednesday December 14, 2016 @09:27PM
(#13181849)
There are other migration techniques. If you know md5(password), you can create bcrypt(md5(password)).
Re:Yahoo discloses hack of 1B accounts
by syncsynchalt on Thursday December 15, 2016 @05:55PM
(#13189443)
That's what I do, though care should be taken that you can't then login against the old passwords by putting md5(password) in the password field.
Usually you do this by decorating the bcrypt(md5(p)) entries in some way so you can recognize which ones are tested with bcrypt() vs bcrypt(md5()).
Re:Yahoo discloses hack of 1B accounts
by cm2187 on Wednesday December 14, 2016 @07:42PM
(#13181246)
I am not sure I agree. Your way will leave all the non active users exposed in the case of a leak. They may not be active on your website but are likely active on another website using the same password.
Re:Yahoo discloses hack of 1B accounts
by user5994461 on Wednesday December 14, 2016 @07:50PM
(#13181301)
As I said, that's an option among others, it has drawbacks.
For a website like Yahoo with billions of abandoned accounts, that's a serious drawback ^^
The other way is to add a new empty column for bcrypt. The next time the user logs in, you save the bcrypt hash and you remove the MD5 hash.
Over time, the active users will be migrated to the new scheme. The only issue is the abandoned accounts, they'll keep the old weak scheme.