Re:Yahoo discloses hack of 1B accounts
by danielweber on Wednesday December 14, 2016 @09:27PM
(#13181849)
There are other migration techniques. If you know md5(password), you can create bcrypt(md5(password)).
[ Parent
| on HN ]
Re:Yahoo discloses hack of 1B accounts
by syncsynchalt on Thursday December 15, 2016 @05:55PM
(#13189443)
That's what I do, though care should be taken that you can't then login against the old passwords by putting md5(password) in the password field.
Usually you do this by decorating the bcrypt(md5(p)) entries in some way so you can recognize which ones are tested with bcrypt() vs bcrypt(md5()).