On: How Not to Do Web Site User Registration

[icey]

Ugh. I wish there was some kind of voting undo. (I accidentally upvoted you.)

First: I assume you mean that Wordpress _definitely_ encrypts their passwords, not defiantly.

Second: What is your proof they they are hashing passwords, salted or not?

[diego → icey]

From the source code of Wordpress MU:

   // If the stored hash is longer than an MD5, presume the
        // new style phpass portable hash.
        if ( empty($wp_hasher) ) {
                require_once( ABSPATH . 'wp-includes/class-phpass.php');
                // By default, use the portable hash from phpass
                $wp_hasher = new PasswordHash(8, TRUE);
        }