Switching away from py-bcrypt backend
See original GitHub issueAs passlib duly notes, all pip versions (and HEAD too) of py-bcrypt
are vulnerable to the BSD wraparound bug:
UserWarning: passlib.hash.bcrypt: Your installation of the 'pybcrypt' backend is vulnerable to the bsd wraparound bug, and should be upgraded or replaced with another backend (this warning will be fatal under passlib 1.7)
Aside from being a serious security vulnerability, being fatal in passlib 1.7+ means it will also make Flask-User unusable under that version until fixed.
Alternative backends supported by passlib like bcrypt should be considered switching to.
Issue Analytics
- State:
- Created 8 years ago
- Comments:12 (6 by maintainers)
Top Results From Across the Web
security - bcrypt in python - Stack Overflow
Now I read somewhere that it is not recommended to use bcrypt in python only because it is too slow and this results...
Read more >Hashing in Action: Understanding bcrypt - Auth0
The bcrypt hashing function allows us to build a password security platform that scales with computation power and always hashes every password ...
Read more >passlib.hash.bcrypt - BCrypt — Passlib v1.7.4 Documentation
A pure-python implementation of BCrypt, built into Passlib. If no backends are available, hash() and verify() will throw MissingBackendError when they ...
Read more >Hashing Passwords in Python with BCrypt - Stack Abuse
Regardless of the size of an input string, the hash will have a fixed size which is predefined in a hashing algorithm itself....
Read more >Hashing passwords with Python and Bcrypt - YouTube
Enjoying this type of content? Head over to my website at https://pythonise.com for full length text based tutorials, courses and guides.
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Thank you all for contributing. It turns out that you need one of the latest versions of passlib to make bcrypt work in Python 3.3 and 3.4. So:
I will update the requirements.txt and setup.py for Flask-User v0.6.7
@scheung38 - I have no idea and I’d also like to know that, but that
bcrypt
issue doesn’t really have to do withFlask-User
in any way beside havingpasslib
as a dependency.