U2.Dmhy News

Passhash Algorithm Upgrade

Site has done a passhash algorithm upgrade recently. Passhashes using new algorithm is 25 million times harder to be cracked by brute-forcing method (testing hardware is Nvidia RTX 3080).

Since we do not store plaintext password, we were unable to convert old passhash to new passhash automatically. Thus, user enrolls into new algorithm only when:

1. Account Registration
2. Password Update (new password could be same as old password)

Algorithm upgrade does not affect user experience and can not be undone.

Since the security of passhash only takes effect in the hypothetical plot of database leak, we do not plan on forcing users to change their password in 2022. From 2023 we may (or may not) display a non-removable upgrade notice (for those not upgraded yet) or simply force user to upgrade.