Quote from: guitarplinker on March 21, 2015, 03:15:47 PM

Quote from: R2D221 on March 17, 2015, 07:03:04 PM

They don't have access to passwords, but what about the password hashes? Why not just transfer the hashes to the new system?

It could be that the new forum has a new method of hashing passwords (different algorithm maybe), so if the old hashes were transferred over, your old password wouldn't work because of the new algorithm.

AFAIK they use same algorithm, SHA-256.

Quote from: theymos on February 25, 2015, 03:00:35 PM

The idea that bcrypt is somehow extra strong is AFAIK entirely a myth. bcrypt is based on a fast Blowfish-based hash function comparable to SHA-256 and other cryptographically-secure hash functions. It makes the entire process slow by hashing the password many times. But this is exactly what any decent key derivation function does.

The forum uses sha256crypt (which has an extremely similar interface to bcrypt) with 7500 iterations. If SHA-256 and bcrypt's underlying hash function were exactly the same speed, this would be equivalent to a bcrypt cost of about 13. I prefer SHA-2 because Blowfish (and especially bcrypt's Blowfish-based hash function) are not as widely used or studied.