A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to bcrypt would mean that every user would need to log in so the password can be migrated.
So my question is, does using bcrypt over md5() reduce it's security?
// For already logged in users:
if (password_verify(md5($_POST['pass']), $DBHash)) {
}
In that way, the whole database could be migrated easily, instead of migrating each user individually.
Should there be any other problem besides the fact that PHP might timeout if not handled correctly? (around 1 second for each hash).