0

I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community user account (similar to StackExchange's) that is locked out from any log in. To do that I created an account and manually set the password_hash field in mysql to ***.

It seems to me that this would effectively lock out the account. Is there anything I can't think of that might leave this account vulnerable?

The hash is a sha-256.

  • 1
    "The hash is a sha-256" DEAR GOD WHY? Don't use SHA256 for passwords. Ever. – Ben Oct 2 '18 at 22:36
  • @Ben: I'm new to password hashing. I was using SHA256 because it is the default for werkzeug.security (I only learned this when I googled the link in my question). But your comment lead me to discover bcrypt (which I'm guessing is a much better choice) and now I have to wonder why werkzeug uses sha-256 as the default? – malan Oct 3 '18 at 13:01
  • 3
    I just now actually went to look at your link and it's not as bad as I assumed. It doesn't use SHA256, it uses PBKDF2-SHA256 which is different...because it uses a salt and iterates the SHA256 thousands of times. Just make sure to tweak the settings to take as long as your server can handle for legitimate logins to still be usable! PBKDF2 was actually the recommended method prior to widespread adoption of bcrypt, scrypt, or argon2. Nowadays there are better choices but PBKDF2 is not necessarily a bad choice if the iteration count is high enough. – Ben Oct 3 '18 at 15:02
  • 1
    Sure, that will never allow a login because there's no way to get a hash to match the too-short signature. – dandavis Oct 3 '18 at 16:29
  • 1
    @malan, yeah I'd ask another question if searching for existing questions doesn't give you the answers you need about selecting a hash algorithm. As I said, PBKDF2 isn't necessarily bad but if you have easy access to a more modern one, it would be better from a security standpoint. Either way it's out of scope for this question. – Ben Oct 3 '18 at 16:32
3

Why not have an additional field for special users? Don't rely on just the password to set your policy -- define your policy in an appropriate field. Username/password is used to authenticate a user. For authorization, build that into your model.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.