Insecure password storage about webtag HOT 4 OPEN

@rieck-srlabs Thanks for the suggestion. Will look into it. What will happen to the existing users who are already created? Do we need to ask them to create new password?

from webtag.

Just curious - why not OAuth? To me, creating / managing yet another password is a barrier to entry, but being able to login with my GitHub (just identity, no permissions), for example, would be a really simple thing to do. It would also allow you to offload user/password management to another provider and focus on your core product.

from webtag.

Disregard my last comment. Just saw issue #4.

from webtag.

What will happen to the existing users who are already created? Do we need to ask them to create new password?

You'll have to migrate them. Asking them to reset their own password would work, but you could also:

1. Add a passwordVersion enum to the userSchema with v1 (current password hashing) and v2 (more secure setup)
2. Add code to logIn that handles both v1 and v2, but that migrates users from v1 to v2 on login (you have the plaintext password then). Alternatively, update all other functionality to use v2, so that any password reset will use the improved setup.
3. Modify the production database accordingly, setting all current users to v1.
4. Wait for users to login and upgrade their password version.
5. Remove migration code once there are no longer any v1 users.

from webtag.