3 ms·
I am most interested to see what the transition from SHA1 to PBKDF2[1][2] will mean for Django. I have wanted to just switch to bcrypt, but it's such a pain in
by kmfrk 15y ago
I am most interested to see what the transition from SHA1 to PBKDF2[1][2] will mean for Django. I have wanted to just switch to bcrypt, but it's such a pain in the ass to manage on Windows and will probably break for users testing my projects locally.
It's not like SHA1 is tantamount to leaving the barn door open, but it doesn't sit well with me to stick with it, until it is replaced natively.
[1]: http://comments.gmane.org/gmane.comp.python.django.devel/33205 http://comments.gmane.org/gmane.comp.python.django.devel/332...
[2]: https://code.djangoproject.com/ticket/15367 https://code.djangoproject.com/ticket/15367
- rglullis 15y agoWhat is wrong with https://bitbucket.org/dwaiter/django-bcrypt/ https://bitbucket.org/dwaiter/django-bcrypt/ ? At least on Linux, I installed it and had no issue whatsoever.
- po 15y agoThere's nothing wrong with django-bcrypt. The main reason for picking PBKDF2 is because it can be implemented without pulling in a dependency to the core framework. The Django team does a lot of work to maintain backwards-compatability and smooth upgrades which is why having this in core is important to me.
- RyanMcGreal 15y agoPython (and Django) prides itself on being cross-platform. Installing bcrypt on Windows is a huge PITA.
- koen 15y agoBut bcrypt is just a few files of portable C (the .S is optional) with no dependencies whatsoever ?