Important Kickstarter Security Notice

Re:Important Kickstarter Security Notice by hga on Saturday February 15, 2014 @05:04PM (#7245576)

(ADJUSTED:) Yes, if when you said "hash the password" you meant the result of what they'd done originally and that was stored in their databe. They don't have a copy of the password until and unless the user logs in again. These are all "one way" or "trapdoor" functions, plaintext -> irreversible cyphertext.

Irreversible in that we think mathematically you can't go back.

[ Parent | on HN ]

Re:Important Kickstarter Security Notice by eropple on Saturday February 15, 2014 @05:24PM (#7245688)

Read his comment again. Hash the password to SHA-1 using the old system, then apply bcrypt to it. It's a migration pattern I've seen in practice a few times.

[ Parent | on HN ]

Re:Important Kickstarter Security Notice by hga on Saturday February 15, 2014 @05:33PM (#7245735)

Thanks! And updated to try to clarify.

[ Parent | on HN ]