I'm looking for some UX examples to how other companies have handled this situation:
Scenario: Devs are using an old password encrypting method (sha1) I believe and need to change it to a more secure encryption.
What they did: When users logged in they just encrypted their password with the new encryption and the users didn't know a thing.
The only problem is we have a number of users who aren't frequent users who will only login periodically.
Devs want to clear all the passwords and require users to reset their passwords.
Problem: We don't want to alert them to the fact that there are security issues as we hold alot of important data in their accounts of users customers.
When that happens users would attempt to login and just get hit with a message saying there login details are incorrect.
The initial approach was....users will eventually just click on forgotten password after being told 'invalid credentials'
However, this just feels wrong and we've tried to think of various flows but due to dev contraints we have to stick with them having to click on the forgotten password. (not the best solution but need to make the most out of this)
My question is... what message would make sense in asking them to reset their password that doesn't alert to security issues?
Additionally are there any existing companies that have handled randomly asking users to reset their passwords?