Truncation to 8 characters is an entropy killer; limiting the range of characters by using the truncated strong hash as the input will reduce it further. In a weak system, you're more likely to find a collision that will effectively substitute for the original password. For two such systems to coexist, you'd need to enforce the use of passwords greater than 8 characters to prevent a crack on the weak system from working on the stronger one.
Comments
Truncation to 8 characters is an entropy killer; limiting the range of characters by using the truncated strong hash as the input will reduce it further. In a weak system, you're more likely to find a collision that will effectively substitute for the original password. For two such systems to coexist, you'd need to enforce the use of passwords greater than 8 characters to prevent a crack on the weak system from working on the stronger one.
Thankyou. This is very interesting. Whenever I study cryptography I feel a bit like Alice going down the rabbit hole.
Thank god the safe best-practices are clear and simple in the majority of cases.
EDIT: in case anyone reading this is wondering, the safe best-practice is to USE BCRYPT.
http://codahale.com/how-to-safely-store-a-password/