Hacker News Reader

I create mobile apps against a REST backend on GAE and I use just basic authentication over https for authenticating the users. I sha1 the password and compare against a sha1 value in the database. Simplest there is but maybe not as secure as other alternatives, but I have not found any big problems with this. Please tell me if I am missing something vital. Have bought a book about OAuth but have not opened it yet. :)

View on HN

Read: http://codahale.com/how-to-safely-store-a-password/

Since you're running on GAE you're likely using either python or java:

Python bcrypt implementation: http://www.mindrot.org/projects/py-bcrypt/

Java bcrypt implementation: http://www.mindrot.org/projects/jBCrypt/

I was aiming more for app <-> app authentications more than app <-> user authentication, but in your case I would definitely use at least a salt for your sha1 hashed passwords.

oAuth seems to have quite a large pool of samples and classes here which I found useful; http://oauth.net/code/

Reply on news.ycombinator.com