I know you've already gotten an answer to this question on another issue, but for the benefit of those who come after, yes, you are correct, and you can read CWD-3812 if you're interested what "compatibility" means.

Great, thanks. So if I set up Crowd and have passwords created/stored there I should have no problem pointing the following to it?

JIRA
Confluence
CrowdID
Gerrit (via CrowdID)

At least as far as password hashes go?

Which incompatibilities exist, specifically?

If you want to move a user database between products, including encrypted passwords, then only ATLASSIAN-SECURITY is supported across all products. If you're using Crowd as a directory server and you're creating and storing passwords only on the Crowd server then bcrypt is an appropriate choice. The current wording is misleading: I've opened CWD-3812 to improve the in-product documentation.

The install still reads "For compatibility between Atlassian products you must use ATLASSIAN-SECURITY."

Which incompatibilities exist, specifically? We would much prefer to use bcrypt but without more detail don't know if we are setting ourselves up for some sort of major fail.

Great, thanks.

Hi Jeff.

Our current default (PKCS #5 v2.0) already uses a random salt and a high iteration count, so it's already a secure algorithm. We won't be switching the default: bcrypt is for those who have a strong preference or require interoperability.

Thanks Joseph for implementing this. I was just reading why bcrypt is better than sha1. Is bcrypt going to be the default?