Conversation
Notices
-
Upgrading users in place from SHA-1 to Bcrypt passwords was more work than I thought.
about 4 months ago from web-
... is that possible without a rainbow table?
-
If you transition people as they log in, yes. Basically, you check their attempted password against the old system, then on success ..
-
.. store the new hash (possible since you briefly have the cleartext password again), and a flag to indicate the old hash shouldn’t be used.
-
Well, more precisely, a flag saying the old hashing method shouldn’t be used. No reason to keep the old hash itself.
-
Oh, that makes sense! And yeah, that would require complexity/hacks, but logical solution
-
Sure; when users log in successfully, rehash their incoming passwords and update them in place.
-
All Identi.ca content and data are available under the