The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props johnbillion.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@soatok @dd32 @Synchro @pkevan Thanks for your input on WordPress#7333 .

This is the linked PR that I wrote at the same time which implements pre-hashing in order to avoid the 72 byte length limit of bcrypt. I've detailed in the description above why a prefix is needed on the resulting hash.

I've just updated it to use hash_hmac instead of manually prepending a prefix on the password value based on the info from @soatok.

If we were to go ahead with pre-hashing, what are your thoughts on this approach?

LGTM. This would satisfy the baseline requirements I mentioned in the other thread.

While there may be some additional security benefit to having another constant added to https://api.wordpress.org/secret-key/1.1/salt/ and then used in the HMAC step, it would also require admins to manage those salts (e.g., when migrating or restoring from backup). This PR balances a minimal operational load with disarming bcrypt's footgun.

More:

https://paragonie.com/blog/2016/02/how-safely-store-password-in-2016#why-bcrypt