Change password hashing

[jamesbondhf]

Seen a lot of threads about it but no actual answer. Can it be done easily? The default md5 salt hash is easy to crack with the right gear and rainbow table. I don't care if its more stressful on the server(It can handle it), I just want to know if something ever goes wrong the password are safe.

[kh99]

Originally Posted by jamesbondhf

Seen a lot of threads about it but no actual answer. Can it be done easily? The default md5 salt hash is easy to crack with the right gear and rainbow table. I don't care if its more stressful on the server(It can handle it), I just want to know if something ever goes wrong the password are safe.

I guess it depends on what you consider to be easy. I don't think it's all that difficult. You can search the vbulletin code for md5(md5( and find the places where the hash algortihm is used, and change it. But a couple of other things to consider are that the current system does an md5 to the password in the browser (if js is enabled), and also if you have existing users you need some way to transition them to the new hash.

I've always though that if you applied the new algorithm to the existing hash, you could avoid both those problems. I.e. make the new algorithm newhash(md5(md5(password).salt)).

There is a mod somewhere here that replaces the hash algorithm, but IIRC it only worked if you have no existing users, otherwise they'd be forced to reset their passwords (which might be OK). Edit: oh, I was thinking of the BCrypt Password Hashing mod that's showing below in the Similar Threads. It's for vb4 but maybe it would work for vb3 as well.

[jamesbondhf]

Originally Posted by kh99

I guess it depends on what you consider to be easy. I don't think it's all that difficult. You can search the vbulletin code for md5(md5( and find the places where the hash algortihm is used, and change it. But a couple of other things to consider are that the current system does an md5 to the password in the browser (if js is enabled), and also if you have existing users you need some way to transition them to the new hash.

I've always though that if you applied the new algorithm to the existing hash, you could avoid both those problems. I.e. make the new algorithm newhash(md5(md5(password).salt)).

There is a mod somewhere here that replaces the hash algorithm, but IIRC it only worked if you have no existing users, otherwise they'd be forced to reset their passwords (which might be OK). Edit: oh, I was thinking of the BCrypt Password Hashing mod that's showing below in the Similar Threads. It's for vb4 but maybe it would work for vb3 as well.

Thanks!