Oh. I see what you mean. I thought you were referring to hash cracking.
MD5 collisions aren't such a problem in vBulletin, really.

+ Also, it would take a lot longer to find a hash collision...

It has nothing to do with vBulletin.

If someone hacks into your server and gets your database dump, they can brute force that to find other possible passwords for your users.

The whole point of BCrypt is to make that impossible by A) being ridiculously slow, and B) being a more crytographically unique hash.

Well, BCrypt is not impossible to brute force, it just takes longer, as you've said.


First of all, if they cracked the MD5, what would they get?
They would get the bcrypt value.
Then what? Then they have to crack that.
That's the pointy.

Wait, so are you talking about:

Dictionary Attacks, or
Rainbow Tables
or hash collisions?

Hash collisions aren't useful, afaik.. they just let you login to your account(or NOT your account) with more than just one password.

NICE :)

this rocks

I have a feeling that after using this, the forums login/reset wise is actually much slower.

Generating the password hash with BCrypt is a bit slower than MD5, but you shouldn't notice any difference on the average server.

Note: the slower the algorithm (and amount of iterations/cost), the longer it takes to brute force passwords, which is a good thing.

If you look at the second piece of code posted above there's a "cost" factor which can be adjusted so that users don't see an objectionable delay.

Updated with a method to set passwords :)

Great Job and a Very good Idea. I have had my friends vB4.x forums hacked where the hackers later Published all forum Users Usernames, Email, and MD5 Password Hashes out in Public. I know by facts that they hacked their way in by decrypting the Admin Password somehow. And NOT by Brute Forcing their way in. We suspected that they got in because of a Custom Skin installed on the forum that was vulnerable.

I am not saying its not possible to Hack or Decrypt a Password by Brute Forcing, But I would rather Secure my forum and Passwords a bit Extra than just leaving the doors open and Welcome them! At least they would use more time to Crack the Passwords.

Thumbs up and Well Done.

Ps, I asssume you could use the same method for vB3.8. So I hope you will create a version for vBulletin 3.8 Users too.