vBulletin's way of password hashing.

[Hell Fox]

I would like to see a mod that changed the way that vBulletin hashed its passwords.

So instead of:
md5(md5($password).$salt)

it could be:
md5(sha1(md5($salt.sha1($password)).$salt)) or something.

This way you could make up a custom hashing method for your board and if someone obtained the db then the db would be useless.

I tried to modfiy my functions_login.php and made it work with that kind of hashing, just didn't work with new accounts registered.

-Fox

[Opserty]

If you start messing with the way passwords are hashed you will have to force users to change their passwords every time you change the hashing method, because the new hashing method will prevent a match with the old hashing methods in the database. To be honest it makes no difference whether they get your password, if they managed to get your DB they have probably got all they need. The won't want to crack your passwords because there would be no need. No one is going to waste time cracking your passwords because what are they going to do with them after? Absolutely nothing most likely. The current hashing method is secure enough theres no real reason to change it.

[Marco van Herwaarden]

Did you ever try to retrieve passwords from a database with the default vBulletin hashing? And did you succeed?