Using Hashlib to Securely store user passwords and credentials.

What is hashing?

Hashing a password means that users cannot have their passwords compromised when a database engineer is reading cleartext in user databases (to a degree, the passwords could be decoded, but hashing them makes them illegible to someone who is not doing anything extensive). And also prevents hackers from reading passwords in plain text and can be compromised by collision attacks.

Additionally when hashing a password a salt may be added to the password, this prevents a database from being attacked by dictionary attacks.

Why Hash Passwords?

Storing User credentials in Plain Text is generally as bad practice as it allows anyone who reads the file (or computer) to see the password, username or any other credential without any sort of protection, In some cases it is against the law, such as PCI SSC Data Security Standards which handles debit and other card types. The solution to this is to Obfuscation in the form of hashing. Hashing a password makes a standard password seem completely random.

How hashing works

When a user signs up for a website or any other form that requires secure credentials, such as a password, username, email address or address, that user will fill in a form that will ask these credentials, then the web server will both hash and store the hash, the server will ‘throw away’ the original password and keep the hash. In a more secure environment the user may also be given a salt, this may be unique to the user or unique to the application (The user will not know the salt, the salt is owned by the server and will be kept secret.). When hashing both the password and salt will be combined and hashed.

How to hash a string in Python

This tutorial uses Hashlib as its hashing encoder which uses the ever bug free OpenSSL…

First we need to import hashlib and encode the input, then finally we need to check for a match.

Xampp and Apache

I recently played around with Apache and fond it incredibly educational.

I used Apache for multiple websites and sub-domains, and its a great web server. and I like Xampp’s user Interface, allowing me to edit, configure and Error check my site.

Xampp Control Panel
Xampp’s user interface, server side

 

Don’t get me wrong though, there are some downfalls when putting it through its paces using Owncloud I discovered that php supported was only allowing 2GB uploads, because it is 32Bit, I later discovered that Xampp is only 32Bit for Windows. This was a major disappointment for me, but I still found workarounds.

Apache is great and easy to use with Xampp, I recommend that anyone wanting to get into web servers and general Web hosting try it out first. I hosted it on my Windows Server, But using a server is completely unnecessary, I was also able to run it on my Laptop.

 

For a test Environment or to start out on Web Servers, I recommend Xampp. Its a trade up over usability and performance on Windows.