We are migrating some users to a new database from a legacy app's database and have written a script to pull the users and all their data from an existing database.
As the user's passwords are hashed we cannot pull these, which is fine, however before we get them to perform a reset I was just wondering what the safest way to do this would be:
- Make the password field NULL and populate the field on reset
- Generate a random password for the user, leave the password field as NOT NULL and populate on reset
Generating a random password seems like extra, unnecessary work however I'm thinking having a NULL password might be a security hole as under normal circumstances all users would have a password, so this would never be NULL.
Can anyone offer some guidance?