enhancementhelp wantedsecurity
Metriche repository
- Star
- (1 stella)
- Metriche merge PR
- (Metriche PR in attesa)
Descrizione
Is your feature request related to a problem? Please describe. Right now, although we use PBKDF2 with a SHA512 hash, we use a static salt and static iteration count. This makes things not quite as secure as they could/should be. We also can't easily increase the iteration count for future purposes.
Describe the solution you'd like We need something more like what Django does: https://github.com/django/django/blob/136ec9b62bd0b105f281218d7cad54b7db7a4bab/django/contrib/auth/hashers.py#L247-L299
In the decode method you can see:
algorithm, iterations, salt, hash = encoded.split('$', 3)
This indicates that passwords are stored in the format:
pbdkf2_sha512$260000$random_string_for_salt$hashed_password
Currently, we only share the last part of that; the hashed_password.