[wp-trac] [WordPress Trac] #63203: Application Passwords BC Break in 6.8's new hashing

[WordPress Trac]

#63203: Application Passwords BC Break in 6.8's new hashing
--------------------------------------+--------------------------
 Reporter:  snicco                    |       Owner:  johnbillion
     Type:  defect (bug)              |      Status:  accepted
 Priority:  normal                    |   Milestone:  6.8
Component:  Application Passwords     |     Version:  trunk
 Severity:  major                     |  Resolution:
 Keywords:  has-patch has-unit-tests  |     Focuses:
--------------------------------------+--------------------------

Comment (by peterwilsoncc):

 Replying to [comment:12 johnbillion]:
 > I think there's some confusion in the pull requests between passwords
 hashed with bcrypt and passwords hashed with BLAKE2b. Application
 passwords use the latter via `wp_fast_hash()` and should not be switched
 to hashing with `wp_hash_password()`.

 @johnbillion Are you able to provide a little more detail here. I find it
 counter-intuitive to use different hashing algorithms for different types
 of passwords.

 I also know some systems use WordPress authentication for external systems
 --for example WordPress.org for SVN, trac, etc--so switching to a forked
 approach for password storage could be problematic for that use case.

 Sorry if this was discussed elsewhere, the original PR and trac ticket are
 long so I couldn't find it when I took a look yesterday.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/63203#comment:15>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform