Hacker News new | ask | show | jobs
by swang 1484 days ago
What were they using to hash passwords? sha256? I actually am curious since they didn't mention it in their email.
1 comments

> The password hashes in this archived data were generated using PBKDF2 or salted SHA1 algorithms previously used by the npm registry. These weak hashing algorithms have not been used to store npm user passwords since the npm registry began using bcrypt in 2017.

Which is so frustrating. When you upgrade your hashing algorithm, always always _always_ immediately remediate the weak hash mess by hashing your weak hashes with your new stronger hash, and turn the login check into

    bcrypt(sha1(user-entered-password)) == stored-bcrypted-sha1
you can then upgrade them to a straight bcrypt if the check succeeds, but keeping the weak hashes on disk indefinitely until the user logs in (if ever!) is such a risk.
I’ve never heard this suggested before. Such a simple elegant solution I’m kinda embarrassed as a security engineer.