If you start messing with the way passwords are hashed you will have to force users to change their passwords every time you change the hashing method, because the new hashing method will prevent a match with the old hashing methods in the database. To be honest it makes no difference whether they get your password, if they managed to get your DB they have probably got all they need. The won't want to crack your passwords because there would be no need. No one is going to waste time cracking your passwords because what are they going to do with them after? Absolutely nothing most likely. The current hashing method is secure enough theres no real reason to change it.
|