> fixing the password security would've required breaking everyone's ability to commit to the PHP codebase
Can’t you have a scheme that is like bcrypt(md5(password)) and since you already have md5(password) in the database you can migrate to bcrypt?
Can’t you have a scheme that is like bcrypt(md5(password)) and since you already have md5(password) in the database you can migrate to bcrypt?
kerberos or even basic auth (because the password can be checked on the server against a real algorithm) would've made this impossible.