Comment by dabeledo

> simply do bcrypt(md5(password))

This could also be problematic.

Password Shucking https://www.youtube.com/watch?v=OQD3qDYMyYQ