Quoting @Anomie's earlier email:

Password manipulation itself:
->mPassword (sadly public!)
->mNewpassword (ditto!)
->isValidPassword() / ->getPasswordValidity() / ->checkPasswordValidity()
->getPassword()
->getTemporaryPassword()
->setPassword()
->setInternalPassword()
->setNewpassword()
->isPasswordReminderThrottled()
Then there's also the stuff for password expiry. It looks like it's mostly unused, actually, except for the minimum necessary so it could work if someone were to use it:

->mNewpassTime (sadly public!)
->mPasswordExpiry (ditto!)
->expirePassword()
->resetPasswordExpiration()
->getPasswordExpired()
->getPasswordExpireDate()
Now-obsolete functions for LoginForm:

->checkPassword()
->checkTemporaryPassword()
And a few miscellaneous static functions:

::getPasswordFactory()
::randomPassword()
::crypt() (already deprecated)
::comparePasswords() (already deprecated)
::passwordChangeInputAttribs() (not deprecated, but a @todo says it shouldn't exist)
Ideally, I'd rip all that out. And mostly it'd be ok, since it's in stuff that really needs update or rewrite for AuthManager anyway (extensions like CentralAuth, ConfirmAccount, SecurePasswords, TwitterLogin, OpenID, BlueSpiceExtensions UserManager, MediaWikiAuth, SemanticSignup, EditAccount where it messes with passwords, OAuthAuthentication, AjaxLogin, SocialLogin). But a few things aren't:
AbuseFilter, TranslationNotifications, MassMessage, DisableAccount, and AutoProxyBlock mess with password stuff when creating their fake users.
Bunch of unit tests do ->setPassword() before adding to the database, which might break if it's assuming LocalPrimaryAuthenticationProvider.
Translate, inexplicably, has its own user creation code.