I've got a few Umbraco sites with both members and users that have useLegacyEncoding=true and thus they're using older, unsalted password hashes.
After digging around a bit I see there's been some chatter on the topic for the past year or so, and some hope to see this get merged into 7.6.x or 7.7.x releases:
If anyone has legacy values set, then the password hashing and management will use the old membership provider way. These legacy values are: AllowManuallyChangingPassword and DefaultUseLegacyEncoding, if either of these are set then the new IUserAwarePasswordHasher will not be used
This would be ideal for us, so as passwords get changed over time they get moved to a more secure storage method, meanwhile older passwords are still functional. (At least that's my understanding of it)
Sub-question on that: Are the password hashes with useLegacyEncoding=true stored as unsalted hashes?
Does anyone know if this is live or functional?
If it is, does anyone have notes for how to start the switch from useLegacyEncoding=true to useLegacyEncoding=false? (and thus be able to take advantage of salted, HMAC-SHA256 passwords)
Nope -- I haven't seen or heard anything back. We're still searching for a solution here. I like the idea of a hybrid, rolling switchover. This would let us proactively email users to change their passwords within the next 6 months (for example).
Hopefully someone @ HQ sees this and can lend their insight.
Proper password hash migration from useLegacyEncoding=true to useLegacyEncoding=false?
I've got a few Umbraco sites with both members and users that have useLegacyEncoding=true and thus they're using older, unsalted password hashes.
After digging around a bit I see there's been some chatter on the topic for the past year or so, and some hope to see this get merged into 7.6.x or 7.7.x releases:
The solutions outlined appear to:
This would be ideal for us, so as passwords get changed over time they get moved to a more secure storage method, meanwhile older passwords are still functional. (At least that's my understanding of it)
Does anyone know if this is live or functional? If it is, does anyone have notes for how to start the switch from useLegacyEncoding=true to useLegacyEncoding=false? (and thus be able to take advantage of salted, HMAC-SHA256 passwords)
Best, Chris
Hi Chris,
I was interested in knowing if you found a solution for migrating users to from legacy hashing to the new salted version.
Surprised Umbraco hasn't addressed this issue and released some type of migration functionality.
Thanks for any insight,
Jeremy
Hi Jeremy,
Nope -- I haven't seen or heard anything back. We're still searching for a solution here. I like the idea of a hybrid, rolling switchover. This would let us proactively email users to change their passwords within the next 6 months (for example).
Hopefully someone @ HQ sees this and can lend their insight.
is working on a reply...