Oct 15, 2025

We have been working to harden our application security.  As part of this process we have been looking at our passwords, and ensuring they are HASHED, SALTED and STRETCHED.  Who knew you could hash salt and stretch a password, but apparently you can.

Some history

When we first released SOBS back in 2007 we didn’t have password hashing which did cause one upset.  By 2008 we were hashing all our passwords and ensuring anybody with a clear text password was converted to a hashed password.

After a few years (around 2011) we learned about different hashing techniques, and we realised that ours was very basic.  It was time for an update.  We implemented the state-of-the-art hashing algorithm that would hash, salt and stretch the stored password, so much that it would take many years for a computer to decode the original password.  When we implemented this we didn’t automatically update everybody to the new hash, we guessed that it would happen naturally as people changed their passwords.

What happened yesterday

I was learning all about hashing, salting and stretching when I took a look at the current passwords in our database.  I noticed that there was a mix of the old and new hashing algorithms.    The old hashed passwords are a security risk, as they potentially could be reverse engineered if the data was compromised.  They really needed to be updated.

I then checked to see if anybody was still using these old passwords, I couldn’t find any record in the server logs where the old passwords were being verified.  If nobody is logging in with these old passwords then the accounts are probably not being used.  In hindsight I should have double checked this as that was not the case, many of these accounts are still being used.

The simplest method was to simply replace these passwords with a secure hashed, salted, and stretched password and then if the account was used again it would require the user to access the password recovery and the new password would then be stored using the new hashed, salted and stretched algorithm.

Repairing the damage

Today we have had a number of calls from schools where the password they have been using for many years has suddenly stopped working.  There is no doubt, this is our mistake and we are very sorry for the inconvenience.

1. If you get the message “Your password is incorrect” this could very well be the problem we have described above.
2. Don’t panic
3. Click the “Okay” button which will take you back to the login form.
4. Now click the “Forgotten password” link below the form.
5. You will be prompted to enter the email address associated with your SOBS account.
6. This will set a temporary password and the change-password-flag, an email will be sent to you including the temporary password.
7. You can now login using this temporary password, you will be prompted for a new password.
8. You may choose to use your old-favourite password however please ensure it is a strong password (not easily guessed).
9. The password you choose will now be stored using the new hashing algorithm.

Thanks for your patience.