python - Password salt & secret -


so when building webapp , storing passwords, both security , performance important things keep in mind. having seen evidence salted sha1 passwords can cracked due increasing speed of gpus, wondering best practices of storing passwords.

i thought in order add more security storing passwords, add secret salt. instance, python code be:

import hashlib import hmac secret = 'xyz' h = hmac.new('salt' + secret, 'password') 
  • is common thing do?
  • what drawbacks of this?
  • what best practices in field?

p.s. didn't post in security forum because want webapp developer's perspective.

also have @ passlib: http://pypi.python.org/pypi/passlib/


Comments

Popular posts from this blog

javascript - backbone.js Collection.add() doesn't `construct` (`initialize`) an object -

php - Get uncommon values from two or more arrays -

Adding duplicate array rows in Php -