Re:Yahoo discloses hack of 1B accounts
by flukus on Wednesday December 14, 2016 @09:43PM
(#13181942)
Yes it could take months or years to complete the process, but they've had at least a decade.
Even if it never completes (abandoned accounts), it would still have saved most active accounts from being breached.
I'm going to go out on a limb and guess you've never worked as a software engineer in a large organisation.
Given MD5 hashes are currently stored, how do you propose user's password get converted to SHA256/512? Should Yahoo brute force the passwords, and then store them in the new algorithm? Or should they wait for the user to log on, verify their password, and store it in the new hash algorithm (given some users rarely log on, this could take over 12 months to complete 80% of users).