Migrate user password hashing algorithm #397

New Issue

Closed

opened 2024-05-05 20:19:28 +02:00 by blacklight · 0 comments

blacklight commented

2024-05-05 20:19:28 +02:00

Owner

bcrypt requires a Rust compiler when Platypush is installed via pip.

On earlier RaspberryPis, or other devices with limited resources, this means very long built times.

Since bcrypt is only used to encrypt the user password on the application db, we can easily replace it a hashlib algorithm (such as pbkd2_hmac) that is already available in the Python standard library.

bcrypt will still be used as a fallback if the user record has no stored password salt/hash iterations, so the migration should be seamless.

bcrypt requires a Rust compiler when Platypush is installed via pip. On earlier RaspberryPis, or other devices with limited resources, this means very long built times. Since bcrypt is only used to encrypt the user password on the application db, we can easily replace it a `hashlib` algorithm (such as `pbkd2_hmac`) that is already available in the Python standard library. bcrypt will still be used as a fallback if the user record has no stored password salt/hash iterations, so the migration should be seamless.