How to change the hashing scheme of already hashed user's passwords
Good news: you're not stuck with a legacy password saving scheme. Here is a trick to transparently upgrade to stronger hashing algorithm.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
Password Storage Cheat Sheet cheatsheetseries.owasp.org
The only way to slow down offline attacks is by carefully choosing hash algorithms that are as resource intensive as possible.
-
Optimizing The Computation Of Password Hashes (2023) helda.helsinki.fi
-
A Well-Known URL for Changing Passwords github.com
🆓 Specification defining site resource for password updates.
-
Lifetimes of cryptographic hash functions valerieaurora.org
“If you are using compare-by-hash to generate addresses for data that can be supplied by malicious users, you should have a plan to migrate to a new hash every few years”.
-
Password expiration is dead techcrunch.com
Recent scientific research calls into question the value of many long-standing password-security practices such as password expiration policies, and points instead to better alternatives such as enforcing banned-password lists and MFA.
-
Breaking Password Dependencies: Challenges in the Final Mile at Microsoft youtube.com
The primary source of account hacks is password spraying (on legacy auth like SMTP, IMAP, POP, etc.), second is replay attack. Takeaway: password are insecure, use and enforce MFA.
IAM › Password-based auth: “Good news: you're not stuck with a legacy password saving scheme. Here is a trick to transparently upgrade to stronger hashing algorithm.”