HOLY FUCK. I'm looking at whether I can migrate customers from WooCommerce to LiteCart for my wife's site and I've just found out that Wordpress hashes its password with a "portable" hash format that does "MD5(salt+password) then 256 passes of MD5(hash + password)".

They used PHPass, which says it's not necessary after PHP 5.5. FIVE POINT FIVE! Even 8.0 went EOL by January _last year_!

They only switched to bcrypt in the VERY LATEST minor version 😱

And for some reason they put bespoke prefixes on the hashes too. So "their" bcrypt is prefixed with `$wp` "to facilitate distinguishing vanilla bcrypt hashes". No, I don't know why either.

Now I've got to mess around with custom password checking, or force password resets 🙄

#Wordpress #Security #BehindTheTimes