#🔒 Is this password storing method good?

26 messages · Page 1 of 1 (latest)

steel bisonBOT
#

Hey @crude atlas!

Please edit your message to use a code block

Add a py after the three backticks.

```py
print('Hello, world!')
```

This will result in the following:

print('Hello, world!')```
#

@crude atlas

Python help channel opened

Remember to:

  • Ask your Python question, not if you can ask or if there's an expert who can help.
  • Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
  • Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.
crude atlas
# 
import hashlib
import base64
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes 

def hash_password(username, password):
    user_salt = hashlib.sha256(username.encode()).digest()[:16]

    input_data = (username + "$" + password).encode()
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,
        salt=user_salt,
        iterations=120000,
    )
    key = kdf.derive(input_data)
    return base64.urlsafe_b64encode(key).decode()

username = "vedant"
password = "1234567"
hashed = hash_password(username, password)
print(f"Hashed password: {hashed}")```
ivory crescent
#

"However, once an attacker has acquired stored password hashes, they are always able to brute force hashes offline. Defenders can slow down offline attacks by selecting hash algorithms that are as resource intensive as possible."

crude atlas
#

But is this algorithm or idea good?

fluid ridge
#

I would use passlib

quick karma
stone pewter
#

i really like passlib too, but it seems to be abandoned since about 4.5 to 5 years ago 😞

#

also, it's not just about using that library and be done, you still need to pick an algorithm to use, I would recommend argon2, specifically the argon2id variant

#

then you also have to configure it with sane parameters

stone pewter
fluid ridge
#

oh wow, it really seems dead. I did not know

stone pewter
fluid ridge
#

okay, there seems to be a passlib fork called libpass on pip, and an alternative called pwdlib

#

I'm biased towards the first one, because the owner of the fork uses a nanachi avatar (which mine is based on as well)

stone pewter
# crude atlas ```py import hashlib import base64 from cryptography.hazmat.primitives.kdf.pbkdf...

reading your code i think it's good that you do have a salt at all, but it would be even better if it was a random one instead of basing it on the username

also, you have way too few iterations, 600_000 (a tip is to write it like that in the code as python allows that for numbers and its easier to read large numbers in an instance if they are grouped like that) is the very minium suggested by the link above

fluid ridge
#

yea, basing it on the username would mean you'd have to ask for the password, if you want to allow changing just the username, as you'd have to recreate the password hash when changing the username

stone pewter
#

i have always been a proponent to using a pepper in addition to a [preferably a random] salt, and it is nice to see OWASP recommending it as well

stone pewter
crude atlas
#

Yes

#

I am travelling which implement all when home

stone pewter
#

i would also tune the parameters as high as both hardware that the code runs on and the usage scenarios allows for (if used by a service that is reachable over a network, especially the internet, consider the risks of denial of service attacks) while still following the OWASP minimum guidelines

crude atlas
steel bisonBOT
#
Python help channel closed with !close

This help channel has been closed. Feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.