Hi all,
D7 has been working out very well, except that it seems some users' passwords will suddenly stop working. There does not appear to be any consistent, recognizable pattern to this; it seems as though random users are affected at random times. But what's clear is that the sha512 hash stored in the database is being changed.
Using the "Request new password" link allows a user to log in once (using the one-time login link), and it even APPEARS to allow them to change their password (no errors, and a confirmation message that the password has been changed). However, logging out and trying to log back in again results in another failed login attempt.
The only way to allow a user to log in normally is to manually re-set his/her password using the admin account. This only works for a time, however, as passwords will suddenly "go bad" without warning. Perhaps the most frustrating thing about this is that it now has happened to my admin account. I re-generated my password using user_hash_password() (from password.inc) and manually inserted that into the appropriate field in my user table in the database, so I have access again, but this is becoming a lot of trouble. Happens on both locally hosted/dev and remote/live site.