How do you update password storage if you don't store the passwords only hashes?
You could upgrade it for new users, but for old ones? (e.g. I don't change passwords often)
You could upgrade it for new users, but for old ones? (e.g. I don't change passwords often)
Of course, that only works for active users - it won't upgrade anyone that never logs in. Depending on just how weak the old hash is, you may want to eventually cut off any lingering un-upgraded accounts: just forget their old hash, requiring them to go through your password reset process should they ever come back. If you've left it long enough, those accounts will probably never be used again anyway, so that should be NBD.