Hacker News Reader

My issue is asking a lot of people to change their password because I've decided to change my encryption algorithm. Is there a best practice for upgrading encryption without forcing users to do that? Something like when the user logs in, hold onto their plaintext password for a bit, confirm it's correct against your current algorithm, and then re-encrypt it with bcrypt?

View on HN

Why not do it behind the scenes?

Simply use the existing MD5/SHA1 hash as input to bcrypt and update all password hashes in your database in one go. Then, whenever the user logs in you first apply the old hash function followed by bcrypt before comparing with what you have in the DB.

Nice, thanks. This is why I asked. That approach had not occured to me.

Good question.

My gut instinct would be to do just that but I wonder if there's a better way. You'd probably also want to track the encryption of each user so you know when you can make the final switch.

Another alternative is to just send "update your password" emails to everyone framing it as an improvement to your site's security.

>Another alternative is to just send "update your password" emails to everyone framing it as an improvement to your site's security.

I guarantee everyone with a decent spamfilter will miss those e-mails - that looks exactly like a standard phishing attempt.

Reply on news.ycombinator.com