www.wikipedia.org password storage disclosures

Wikimedia Foundation, Inc.

Rating B

PBKDF2 (since March 2016, disclosed March 2016)

Params: hash=SHA-512, iterations=128000

Disclosures:

PBKDF2 (disclosed September 2014)

Params: hash=SHA-512, iterations=64000

Disclosures:

Salted MD5 (disclosed August 2014)

Disclosures:

A slow hashing function is used but such info is "invisible", hidden in a blog post or a talk, or on social media.

Recommended change: Publish storage and hashing info details visibly (e.g. in the docs or FAQ), then let me know.