4 ms·
In this thread: People don't read the PEP and make knee-jerk assumptions. In the PEP (https://peps.python.org/pep-0594/#crypt https://peps.python.org/pep-0594/
by dharmab 3y ago
In this thread: People don't read the PEP and make knee-jerk assumptions.
In the PEP (https://peps.python.org/pep-0594/#crypt https://peps.python.org/pep-0594/#crypt) it points out that this module didn't work on Windows at all and didn't provide any useful real-world functionality on Linux, BSD or macOS.
The use case mentioned in this blog (SHA512 password hashing) is considered a bad practice because unlike bcrypt, SHA512 is fast for an attacker to execute to check if a credential guess matches a hash.
- Tomte 3y ago> People don't read the PEP and make knee-jerk assumptions. They just came over from the Java string interpolation thread, because after not reading the JEP they weren‘t sure how to spend the rest of the evening and thought „I know! Now I will not read the PEP.“ /s
- hannob 3y agoThe PEP is not accurate, probably outdated. Linux distros are converging towards using libxcrypt with yescrypt, which is a modern password hashing function. If you have a crypt function that wires back to libxcrypt's crypt, you can use that. It's a bit unfortunate that people seem to be unable to agree on a modern password hash (other places tend to use scrypt or argon2), but well, I think yescrypt is fine, and having a way to generate and verify crypt-compatible hashes is certainly useful functionality.