5 ms·
I'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same.
by pjscott 15y ago
I'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same. When a user gives you their password for the first time, here's what you store in your database:
hashed_password = bcrypt.hashpw(password, bcrypt.gensalt())
Store hashed_password in your database for later. Then, when a user tries to log in, they will tell you their password. You'll need to check that it matches the hashed_password value you have stored. Here's how:
if bcrypt.hashpw(password, hashed_password) == hashed_password:
print 'Password is correct!'
else:
print 'Wrong password.'
That's all there is to it. The bcrypt library handles everything else. It is this simple because if it weren't, people would mess it up.
- dchest 15y agoYour verification code is wrong. See http://codahale.com/a-lesson-in-timing-attacks/ http://codahale.com/a-lesson-in-timing-attacks/ Edit: I'm wrong, sorry.
- deleted 15y ago[deleted]
- tptacek 15y agoWait, what? What's the attack you're thinking of here? How would it actually work?
- dchest 15y agoHah, you're right. It's practically impossible to generate passwords in such way that they will give hashes differing by only a byte. Sorry, I see timing attacks everywhere.
- tptacek 15y agoHave you actually ever written an exploit for one? It'll cure you of that problem really fast. (I'm being serious, not snarky).
- dchest 15y agoThis is actually a very good advice, especially for people like me who have hard time visualizing how complex things work. For example, when I tried to understand what the meet-in-the-middle attack is, and couldn't, it was incredibly helpful to implement it (https://gist.github.com/1062437 https://gist.github.com/1062437). Then I understood.