Holding up older versions of Wordpress as an example of how to do security is not really a defensible positionGamma-UT wrote: Sun Aug 02, 2020 6:45 amThat’s nor necessarily true. In older versions, Wordpress used to email an automatically generated password on account creation in plaintext but hash the password it then stored in the database. However, for later changes, it would use the magic-link method.kidslow wrote: Sat Aug 01, 2020 11:35 pm There is one certain way you can know that your password is NOT encrypted -- If you are emailed the password in plaintext. If it's properly encrypted, there should be no means for them to do that. The more secure sites will email you a link to change your password.
I get your point, so to be more specific, if you see a password that you created coming back to you in plain text in an email, you can be guaranteed that it's not being stored in encrypted form. Even to be more specific, did these older versions of Wordpress SALT the hash?
