Change $wgPasswordDefault to PBKDF2 on WMF wikis
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	Parent5446
	Jul 28 2014, 8:20 PM

Description

The password hashing API patch has been merged. Once it is deployed, we should switch WMF wikis over to PBKDF2.

Version: wmf-deployment
Severity: enhancement

		Status	Subtype	Assigned	Task
		Resolved		None	T70766 Change $wgPasswordDefault to PBKDF2 on WMF wikis
		Resolved		Parent5446	T30419 Replace MD5 password hashing with more secure hash

• bzimport raised the priority of this task from to Medium.Nov 22 2014, 3:29 AM

• bzimport set Reference to bz68766.

• bzimport added a subscriber: Unknown Object (MLST).

(In reply to Tyler Romeo from comment #0)

The password hashing API patch has been merged.

Change 153850 had a related patch set uploaded by Parent5446:
Set $wgPasswordDefault to old MD5

Change 153850 merged by jenkins-bot:
Set $wgPasswordDefault to old MD5

Maybe it is possible to keep/set PBKDF2 on labs wikis for testing and only set to md5 for production.

Change 158024 had a related patch set uploaded by Parent5446:
Set password default to PBKDF2

Change 158024 merged by jenkins-bot:
Set password default to PBKDF2

successfully merged