4 ms·
As far as I know, that is correct.[1] Any change, whether for work factor or algorithm in code still waits for the user to come back and attempt a login, at whi
by tempVariable 11y ago
As far as I know, that is correct.[1]
Any change, whether for work factor or algorithm in code still waits for the user to come back and attempt a login, at which point you update the database stored attributes and the hash.
I think that if you can update a user's password without them inputting, then you have two problems.
[1]not authoritative advice.
edit: seems that comments suggest doing the md5(bcrypt(hash)) can be used to upgrade across the board
- rurounijones 11y agoI thought that a while ago but then someone just pointed out that you bcrypt hash the MD5 hash and support two step (MD5 then bcrypt) until they login at which point you can rehash using only bcrypt.
- artursapek 11y agoThat's a much smarter approach. Never thought of that.