4 ms·
In the "What We've Done" section, there's no mention of changing the password hashing algorithm away from md5 to bcrypt or PBKDF2.
by bashinator 13y ago
In the "What We've Done" section, there's no mention of changing the password hashing algorithm away from md5 to bcrypt or PBKDF2.
- richadams 13y agoLater in the page (in the "Hardening" section), they mention that they've switched the forums to use Ubuntu SSO for authentication, instead of needing to store forum passwords.
- plywoodtrees 13y agoAnd I wonder what hashing approach Ubuntu SSO uses?
- rlpb 13y agoI think this is an unreasonable expectation if the upstream vBulletin code doesn't support it.