On: Lifetimes of cryptographic hash functions

[nly]

So migrate? Hash the hashes with Bcrypt or PBKDF2.

Bcrypt(MD5(password)) is just as effective as Bcrypt(password) at knocking brute force attempts on the head.

[finnw → nly]

Unless the Bad Guys already have the MD5 hashes

[Xylakant → finnw]

Then the problem is not "I support an app that uses md5 hashes" any more. Your problem in that case is "all my users accounts were broken."

[nly → finnw]

Right, but you can still perform the migration I suggested and flag accounts for a password reset on next login.