python - Password salt & secret -
so when building webapp , storing passwords, both security , performance important things keep in mind. having seen evidence salted sha1 passwords can cracked due increasing speed of gpus, wondering best practices of storing passwords.
i thought in order add more security storing passwords, add secret salt. instance, python code be:
import hashlib import hmac secret = 'xyz' h = hmac.new('salt' + secret, 'password')
- is common thing do?
- what drawbacks of this?
- what best practices in field?
p.s. didn't post in security forum because want webapp developer's perspective.
also have @ passlib: http://pypi.python.org/pypi/passlib/
Comments
Post a Comment