Change password hashing

[jamesbondhf]

Originally Posted by kh99

I guess it depends on what you consider to be easy. I don't think it's all that difficult. You can search the vbulletin code for md5(md5( and find the places where the hash algortihm is used, and change it. But a couple of other things to consider are that the current system does an md5 to the password in the browser (if js is enabled), and also if you have existing users you need some way to transition them to the new hash.

I've always though that if you applied the new algorithm to the existing hash, you could avoid both those problems. I.e. make the new algorithm newhash(md5(md5(password).salt)).

There is a mod somewhere here that replaces the hash algorithm, but IIRC it only worked if you have no existing users, otherwise they'd be forced to reset their passwords (which might be OK). Edit: oh, I was thinking of the BCrypt Password Hashing mod that's showing below in the Similar Threads. It's for vb4 but maybe it would work for vb3 as well.

Thanks!