question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Cannot specify LongPasswordStrategy on Verifier

See original GitHub issue

Hello,

First of all, thanks for this library.

In my code, I need to be able to specify the LongPasswordStrategy to TruncateStrategy so the lib behave like others (in others softwares in different languages).

It all works well when saving the hash, I can do BCrypt.with(LongPasswordStrategies.truncate()).hash(...) just fine.

But when I want to verify a hash, I can’t specify the strategy! One would expect BCrypt.with(LongPasswordStrategies.truncate()).verifyer().verify(pw, hashData); to works, but alas no.

Looking quickly in the code, I can see that you simply use the withDefaults() without offering any choice to the user: https://github.com/patrickfav/bcrypt/blob/master/modules/bcrypt/src/main/java/at/favre/lib/crypto/bcrypt/BCrypt.java#L551

Is there something I’m missing? I would think the library should be able to verify its own generated hash depending on the strategy used…

Thanks.

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:6 (3 by maintainers)

github_iconTop GitHub Comments

1reaction
patrickfavcommented, Oct 20, 2019

Will be released with v0.9.0

1reaction
Indigo744commented, Oct 20, 2019

Thank you. I reviewed it, looks good!

Read more comments on GitHub >

github_iconTop Results From Across the Web

Interoperability issue with PHP implementation (and others ...
If we take this hash and try to verify it using PHP (using password_verify()), ... Cannot specify LongPasswordStrategy on Verifier #21.
Read more >
at.favre.lib.crypto.bcrypt.BCrypt Java Examples
Result result = BCrypt.verifyer().verify(arguments.password, arguments. ... e) { throw new IllegalStateException("Cannot parse hash with salt '" + salt + ...
Read more >
Telepathwords: A New Password Strength Estimator
Telepathwords is a pretty clever research project that tries to evaluate password strength. It's different from normal strength meters, and I ...
Read more >
bcrypt - Maven Artifact: at.favre.lib - JarCasting
BCrypt.verifyer(LongPasswordStrategies.truncate()).verify(pw, hash); ... To improve security, you should set that number as high as you can tolerate on your ...
Read more >
Hands-on Scala Programming By Li Haoyi - VBOOK.PUB
You can run the executable assembly to verify that it does what you expect: ... Note that val s are immutable: you cannot...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found