home.social

#behindthetimes — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #behindthetimes, aggregated by home.social.

fetched live
  1. HOLY FUCK. I'm looking at whether I can migrate customers from WooCommerce to LiteCart for my wife's site and I've just found out that Wordpress hashes its password with a "portable" hash format that does "MD5(salt+password) then 256 passes of MD5(hash + password)".

    They used PHPass, which says it's not necessary after PHP 5.5. FIVE POINT FIVE! Even 8.0 went EOL by January _last year_!

    They only switched to bcrypt in the VERY LATEST minor version 😱

    And for some reason they put bespoke prefixes on the hashes too. So "their" bcrypt is prefixed with `$wp` "to facilitate distinguishing vanilla bcrypt hashes". No, I don't know why either.

    Now I've got to mess around with custom password checking, or force password resets 🙄

    #Wordpress #Security #BehindTheTimes