Closed Bug 1257257 Opened 10 years ago Closed 10 years ago

Make password hashers configurable, and default to bcrypt

Categories

(Shield :: General, defect)

Product:
Shield
Component:
General
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: mythmon, Assigned: mythmon)

Details

The default Django password hasher is PBKDF2PasswordHasher, which is pretty good, but have some known issues. A better option is BCryptSHA256PasswordHasher. It is not the Django default because it requires an extra library. This bug covers making the default hasher include bcrypt as the default option (it will have to still include PBKDF2 so old passwords work). It also covers making this something we can configure with environment variables, in case we want to upgrade this in the future.
Docs: https://docs.djangoproject.com/en/1.9/topics/auth/passwords/#using-bcrypt-with-django
Assignee: nobody → mcooper
Status: NEW → ASSIGNED
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Component: SHIELD → General
Product: Websites → Normandy
You need to log in before you can comment on or make changes to this bug.