Hacker News Reader

Comment by bdcravens | Hacker News Reader

You don't need original password, hash the hash.

    if date < '2016-01-01'
        return newly_hashed == new_hash(old_hash($password))

And hash twice again during login/password lookup then? Can be done, but tedious.

Sure, not ideal, but would prevent mass password updates.

Yes, but it happens only the first time, if you update the stored hash with newHash(plaintext_password)