Suggestion: Password Hashing

[Aventro]

We discussed back earlier on the password hashing, as it is currently weak, I think we all can agree on this. The problem was that Boother didn't want to break games running on the current version of ezRPG as it would disallowing them making further updated. However, I think that reason is bad, seeing as:

1) Not many games are running on ezRPG, it is a dead engine with loads of potential.

2) It makes the game more insecure than needed.

My proposal is to implement a new password hashing algorithm, i.e. one used in the rework of ezRPG that never was finished. But to keep it backward compatible we simply first checks the password with our new password implementation and If it's incorrect (returns false) we simply check with the old one, if that one is correct we simply rehash the password, storing it in the database, and hey, we never getting to that else if statement again!

[Spudinski]

Convince at the cost of security is not the proper way to go.

When changing a password hashing algorithm, it's usually suggested that you reset all passwords, and ask the user to change it(much like the 90-days password expiration).

Additionally, if the user does not receive the password change request you can do something similar to Facebook.

When an old password is entered, tell the user so without logging them in and explain the current situation with a link to the password reset page.

[Aventro]

Convince at the cost of security is not the proper way to go.

When changing a password hashing algorithm, it's usually suggested that you reset all passwords, and ask the user to change it(much like the 90-days password expiration).

Additionally, if the user does not receive the password change request you can do something similar to Facebook.

When an old password is entered, tell the user so without logging them in and explain the current situation with a link to the password reset page.

That would require to store the old password which would need to reorganize the table structure of the database, but yes, that's one solution as well. My point is too make it happen!