Adding extra Password Encryption to vB3.8.7

[Brexen]

Hi there,

I was wondering if it would be possible to add second layer of password encryption and if so, how would I go about doing this.

My idea is to start with;

a Password such as apple,
which would then be MD5 Salted to; 182253a9eb3f347c77f80803dab0fb7e:WN]
but then 182253a9eb3f347c77f80803dab0fb7e:WN] goes through another MD5 Salted encryption to 955e31340a1f5991a80cd73d6b3a9685:O%\

A few of our Passwords have been cracked with PasswordsPro, so I think it's about time we all thought of better security. No dictionaries or any program will crack Hashed Hashes especially SaltedMD5 ones.

[kh99]

I believe passwords are already encrypted using md5 twice, although salt is only included the second time. As far as changing how it works, you'd have to find everywhere the password is handled and change it. There's verify_authentication() in includes/functions_login.php and code which sets/updates the password in profile.php and register.php. There may be other places I don't know about.

I'm wondering though, for passwords to be cracked via PasswordPro you'd need the hashed version. Where are the "crackers" getting this? Maybe I'm missing something, but it seems like a more productive approach would be to address that.