It was recommended by Mozilla InfoSec that we implement a feature that allows us to force a password reset for all of our users in the worst-case scenario where our bcrypt'd passwords have been dumped and posted publicly.
We'll need to:
[ ] Implement a feature to force users to change their password
[ ] Implement a feature that displays a message why we're forcing people to change their password
[ ] Come up with a rough draft of copy that we could use in a blog post to explain what has happened
It was recommended by Mozilla InfoSec that we implement a feature that allows us to force a password reset for all of our users in the worst-case scenario where our bcrypt'd passwords have been dumped and posted publicly.
We'll need to: