Need to replace crypt with bcrypt

[dagolden]

Passwords are hashed with crypt, which is -- in this day and age -- extremely insecure.

It should be replaced with bcrypt and some sort of upgrade procedure should be put in place to auto-upgrade passwords to bcrypt hashing when users log in.

For users that don't log in regularly, we should consider whether simply to invalidate their passwords in some way that avoids a brute force attack but allows a user to recover and set a bcrypt hashed password.

[dolmen]

The password auto-upgrade should also be triggered by a CPAN upload over https.

[wolfsage]

This is already complete and live by the looks of it?

[andk]

Yes, thanks, closing