3 ms·
Blimey, it's taken until now to get bcrypt in Wordpress? What the heck took them so long?
by anexprogrammer 11y ago
Blimey, it's taken until now to get bcrypt in Wordpress?
What the heck took them so long?
- jammycakes 11y agoWhat's more shocking is that not only are they not using bcrypt, they're still using MD5. Correct me if I'm wrong, but aren't there organisations being prosecuted in some jurisdictions for having password security that weak?
- anexprogrammer 11y agoWouldn't surprise me, it's had lots of exposure with all the data leaks. I last looked at passwords sometime in 2010 off the back of the infamous "use bcrypt" post. Just skimmed the WP ticket, what a horrible amount of effort to cover an edge case of people regressing to a 4 years past dead PHP version.
- Eric_WVGG 11y agoread it again, Wordpress still doesn’t have it. These guys just got fed up and provided a workaround.
- anexprogrammer 11y agoOops, too much skimming. Kudos to the roots folks for getting involved and sorting it.