4 ms·
I'm reading this thread from top to bottom and it looks like both sides are talking past each other. His point: His plugin is a wrapper that provides a basic f
by statictype 16y ago
I'm reading this thread from top to bottom and it looks like both sides are talking past each other.
His point: His plugin is a wrapper that provides a basic framework for handling authentication. He's not implementing his own cryptography. He happens to use an SHA256 construction as part of it because that's what he's seen as one of the standard ways of handling passwords.
Your point: Don't use salted SHA256 for passwords. Use bcrypt.
I think this whole conversation could have been snipped off if you had started with "change auto_hash to use bcrypt instead of SHA256 since it's more secure".
- tptacek 16y agoIt'd be great if he fixed auto_hash to use bcrypt instead of SHA256; this is, after all, the entirety of my original comment about his code. Just be aware that once he replaces auto_hash with bcrypt, auto_hash has literally no functionality anymore; bcrypt-ruby already does all of what auto_hash does, better.
- KevinMS 16y agoI'm on it right now, would have been done last night but having trouble with rails 3.0 and gem paths. But its not true it wont have any functionality, it does what it claims to do, which isn't much, but its something. Putting auto_hash :password, :field2, :field3 In a model will automate the process of "cryptofying" (using a fake word to avoid any more terminology disputes) database fields :password, :field2, :field3 upon save or update Then it will give you a dynamic accessors like user.password_match?, user.field2_match? This saves lines of ugly code I don't want to look it, and also frees up the models before_save hook. Amendment: I think this will make auto_hash the only auth related plugin that defaults to, and only offers, bcrypt
- tptacek 16y agoYeah, bcrypt-ruby already does that, doesn't it?
- KevinMS 16y agoThats up to you to decide, here a comparison: Here is bcrypt-ruby class User < ActiveRecord::Base include BCrypt def password @password ||= Password.new(password_hash) end def password=(new_password) @password = Password.create(new_password) self.password_hash = @password end end Here is auto_hash class User < ActiveRecord::Base auto_hash :password end
- tptacek 16y agoNot sure I'd want to introduce a plugin dep to get rid of 7 lines of code (you don't need the "include"), but, OK.