Comments by rizdplex (Top 2 by date)

rizdplex 22-Jan-16 4:57am View

Thanks for all your valuable comments, Our application is acessed across by millons users, practically migrating them would be a long time process and that happen with time as application is used. And your comments are going to be helpful.

Would like to elaborate part of the question depending upon the feedback you have provided
"After upgrading our application to SHA2 with above settings, we expect that the older users passwords(which was encrypted using SHA1 and already present in memebership database) will not work with SHA2 alogorithm. But it allows older users to login without any modification in previously encrypted password. "

the application uses Asp.net Membership concept for mantaining login credentials, after specifying SHA2 as algorithm to be used for authenticating the user ideally depending upon feedback from your side it should not allow login but to out strange it allows old passwords hashed using SHA1 sucessfully login into the application .
My question is what hashing algorithm does Asp.net Membership concept use for Hashing passwords.

rizdplex 22-Jan-16 4:56am View

Thanks for all your valuable comments, Our application is accessed across by millions users, practically migrating them would be a long time process and that happen with time as application is used. And your comments are going to be helpful.

Would like to elaborate part of the question depending upon the feedback you have provided
"After upgrading our application to SHA2 with above settings, we expect that the older users passwords(which was encrypted using SHA1 and already present in membership database) will not work with SHA2 algorithm. But it allows older users to login without any modification in previously encrypted password. "

the application uses Asp.net Membership concept for mantaining login credentials, after specifying SHA2 as algorithm to be used for authenticating the user ideally depending upon feedback from your side it should not allow login but to out strange it allows old passwords hashed using SHA1 successfully login into the application .
My question is what hashing algorithm does Asp.net Membership concept use for Hashing passwords.