I'm currently using a salted MD5 hash on my site which uses a random salt given to each user. I have a feeling the latest articles in the news aren't as bad as they seem, but should this be a big enough concern to think about switching over to SHA1 or even a mix of the two?
Also what is the standard procedure for changing hashing methods for a site? Unlike AES you can't decrypt a password then rehash it.
If I do transfer I'm thinking of implementing a 180 day policy on the site for password removal. So after that happens the user will be forced to recreate their password after verifying it through their email and using the password recovery system. In that 180 day period, every user that logs in will be checked under the old and the new method. If they are under the old MD5 method, then they will be updated automatically, other wise if they don't, they'll just have to recreate the password after 180 days.
...
Go to the complete details ...