diff --git a/package.json b/package.json
index 7c2914f..b140ad5 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
   },
   "dependencies": {
     "eraro": "0.4.1",
-    "lodash": "3.10.1",
+    "lodash": "4.13.x",
     "node-uuid": "1.4.7"
   },
   "devDependencies": {
diff --git a/user.js b/user.js
index 26653e4..ab0641c 100644
--- a/user.js
+++ b/user.js
@@ -326,6 +326,11 @@ module.exports = function user (options) {
             }
             else return done(null, {ok: false, why: 'user-not-found', nick: q.nick, email: q.email})
           }
+
+          if (_.isBuffer(user.pass)) {
+            user.pass = user.pass.toString('utf8')
+          }
+
           args.user = user
 
           return cmd.call(seneca, args, done)
@@ -623,6 +628,7 @@ module.exports = function user (options) {
       return make_login(user, 'auto')
     }
     else {
+
       seneca.act({role: role, cmd: 'verify_password', proposed: args.password, pass: user.pass, salt: user.salt}, function (err, out) {
         if (err) return done(err)
         if (!out.ok) {