As Dylan stated, an example of a way to do this on login without storing passwords in plaintext:
login():
needsPasswordDoubled = [has user changed password since XX date?]
username = [username post parameter]
password = [password post parameter]
if login successful:
if needsPasswordDoubled:
replace stored password hash with hash(password | password)
else:
return success
return failure
Done. That said, the security of this is a joke: anyone who wants to compromise McGill accounts and (a) has a valid (old) username and password and (b) has seen this public press release is simply going to double all of their compromised passwords. But still, typing a double-password is annoying if you don't want to do it. So this is really just a way to "force" people to change their passwords without forcing a password reset.
The security of this is a joke because this isn't a security move. It's not designed to make the users secure after the Heartbleed vulnerability. It's purely designed to make logging in annoying for the users, so they finally change the password they should have changed a while ago.
Seems a heck of a lot better than force-expiring passwords like I'd expect any other company to do.
Blocking login until they've changed their password is too harsh, and it's counter-productive.
A college student who needs to choose a new password now but is under time pressure is definitely not going to take recommended steps like "go install a password manager that'll generate a secure random password for you." They may not even have a piece of paper on hand right now, so they will choose a password that they can remember.
Like -- their previous password, but "2" instead of "1" at the end....
Whereas if you just give them a nudge like this, they will bear the annoyance of typing it twice if they're in a rush, then when time permits they can choose a decent replacement.
