Hacker News Reader

Comment by pbreit | Hacker News Reader

Besides "use bcrypt" I've never really seen decent guidance on how to actually store passwords (what sort of salt to use, where to store the salt, if and where to store the hash method, how/where to store the key, etc).

View on HN

I'll write one for you right now, because it really is as simple as I made it sound. I'll use the API from py-bcrypt here, but they're all pretty much the same. When a user gives you their password for the first time, here's what you store in your database:

    hashed_password = bcrypt.hashpw(password, bcrypt.gensalt())

Store hashed_password in your database for later. Then, when a user tries to log in, they will tell you their password. You'll need to check that it matches the hashed_password value you have stored. Here's how:

    if bcrypt.hashpw(password, hashed_password) == hashed_password:
        print 'Password is correct!'
    else:
        print 'Wrong password.'

That's all there is to it. The bcrypt library handles everything else. It is this simple because if it weren't, people would mess it up.

Your verification code is wrong. See http://codahale.com/a-lesson-in-timing-attacks/

Edit: I'm wrong, sorry.

Wait, what? What's the attack you're thinking of here? How would it actually work?

Hah, you're right. It's practically impossible to generate passwords in such way that they will give hashes differing by only a byte. Sorry, I see timing attacks everywhere.

Have you actually ever written an exploit for one? It'll cure you of that problem really fast.

(I'm being serious, not snarky).

This is actually a very good advice, especially for people like me who have hard time visualizing how complex things work. For example, when I tried to understand what the meet-in-the-middle attack is, and couldn't, it was incredibly helpful to implement it (https://gist.github.com/1062437). Then I understood.

"Use bcrypt" is the answer to all those things. Bcrypt includes a salt, which is stored along with the method in the hash string. Hashing is not the same as encryption, so there is no key involved.

If you are using PHP then do this:

    $salt = '$2a$08$' . $random_data;
    $hash = crypt($password, $salt);

$random_data is 22 random letters from A-Za-z0-9.= (16.5 bytes)

(08 is the cost factor - you can change it, but 8 seemed reasonable in my tests.)

If you google bcrypt and php you'll find a very complex and large class for doing this. It's no longer necessary - current versions of PHP have it built in.

Marco Arment (marco.org) has written a nice wrapper for it.

https://gist.github.com/1053158

Reply on news.ycombinator.com