Comment by moloch

I think their main mistake was requiring a user to change their password to upgrade the hash instead of upgrading the hash on the next user login.