Message7701
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
Provides some notes on upgrading older hashes. It points out that automatic hash
upgrade can leave the account vulnerable if the old hashes get cracked. They suggest
a password reset when rehashing/upgrade.
Also what to do about accounts where users have not logged in. They suggest obsolete the
passwords and require a password reset.
Also scrypt is part of hashlib as of python 3.6. So maybe we could support scrypt from
hashlib if available. I doubt anybody would want to go from python 3.6 to 2.7
(without built-in scrypt). The owasp linked above has minimum settings for for scrypt.
But we should plan on allowing these to be stored with the passwords and changed. |
|
Date |
User |
Action |
Args |
2022-12-23 05:24:50 | rouilj | set | messageid: <1671773090.68.0.232970185025.issue2551145@roundup.psfhosted.org> |
2022-12-23 05:24:50 | rouilj | set | recipients:
+ rouilj, ced |
2022-12-23 05:24:50 | rouilj | link | issue2551145 messages |
2022-12-23 05:24:50 | rouilj | create | |
|