News for hackers. Stuff that matters.

A comment on Important Kickstarter Security Notice. Parent comment

Re:Important Kickstarter Security Notice by akerl_ on Saturday February 15, 2014 @05:31PM (#7245729)
Except that for some people, you only have a SHA1 hash, and for others, you only have an scrypt hash. Since they (I hope) weren't storing the plaintext (pre-hash) passwords alongside the hashed versions, the only time they can change the initial hashing mechanism is when passwords are provided to them during a password change or user login.
[ Parent | on HN ]
Re:Important Kickstarter Security Notice by ErrantX on Saturday February 15, 2014 @05:47PM (#7245798)
Hash all the sha1 passwords with scrypt. Hash all new passwords with sha1 then scrypt.

Your new hash mechanism is sha1 then scrypt.

There is no excuse to do otherwise :)

[ Parent | on HN ]