Re: [Pharo-project] How to encrypt a password?
"Milan Mimica"<milan.mimica@gmail.com> wrote:
Yes, having the salt randomly generated and storing it with a hash is a better idea. Note taken. Combining it with a fixed salt (and trying to keep it secret) is even better. Keeping a hardcoded salt in the image running on the remote machine serving WEB pages makes it quite secret IMO.
I was referring to Mariano's intent (at least how I understand it) to hardcode it "in code". If he's confident he'll be able to keep the code secret then hey may as well have the password in it in plain text, hashing it with or without salt, doesn't make much difference IMO. Generating random salt and keeping a hashed password on a deployed system is a different scenario. In this case it's different and unpredictable with every deployment. When it's hardcoded it's the same everywhere.
On Wed, Oct 26, 2011 at 12:36 AM, <mkobetic@gmail.com> wrote:
"Milan Mimica"<milan.mimica@gmail.com> wrote:
Yes, having the salt randomly generated and storing it with a hash is a better idea. Note taken. Combining it with a fixed salt (and trying to keep it secret) is even better. Keeping a hardcoded salt in the image running on the remote machine serving WEB pages makes it quite secret IMO.
I was referring to Mariano's intent (at least how I understand it) to hardcode it "in code". If he's confident he'll be able to keep the code secret then hey may as well have the password in it in plain text, hashing it with or without salt, doesn't make much difference IMO.
Yes, indeed. I didn't give details. It was something very very stupid and simple. All I wanted to do is to commit a class I use to build my images and such class sets my username/password for squeaksource repotistories. But I didn't want to put such password in the code... at the end what I did (because my scenario is really stupid and only for me), is to read the password from a file in my machine :) hahahahha Anyway, I learn from the thread :)
Generating random salt and keeping a hashed password on a deployed system is a different scenario. In this case it's different and unpredictable with every deployment. When it's hardcoded it's the same everywhere.
-- Mariano http://marianopeck.wordpress.com
But I didn't want to put such password in the code... at the end what I did (because my scenario is really stupid and only for me), is to read the password from a file in my machine :) hahahahha
That would be the kind of thing that belongs to a .pharoconf file in your /home directory ;)
Off topic, but is the use of a .pharoconf file documented somewhere? On Wed, Oct 26, 2011 at 05:12, Francois Stephany <tulipe.moutarde@gmail.com> wrote:
But I didn't want to put such password in the code... at the end what I did (because my scenario is really stupid and only for me), is to read the password from a file in my machine :) Â hahahahha
That would be the kind of thing that belongs to a .pharoconf file in your /home directory ;)
-- ~JT
On Wed, Oct 26, 2011 at 5:54 PM, John Toohey <jt@parspro.com> wrote:
Off topic, but is the use of a .pharoconf file documented somewhere?
No at all. Pharo does know nothing about it. It is just a plain file you can create and read stuff from there...just as any other file in any other language :)
On Wed, Oct 26, 2011 at 05:12, Francois Stephany <tulipe.moutarde@gmail.com> wrote:
But I didn't want to put such password in the code... at the end what I did (because my scenario is really stupid and only for me), is to read the password from a file in my machine :) hahahahha
That would be the kind of thing that belongs to a .pharoconf file in your /home directory ;)
-- ~JT
-- Mariano http://marianopeck.wordpress.com
If anyone is interested we have some stuff that can read/write KeyedTrees as XML files (registry type of configs but with proper objects (storeString based)). Regards, Gary ----- Original Message ----- From: Mariano Martinez Peck To: Pharo-project@lists.gforge.inria.fr Sent: Wednesday, October 26, 2011 5:05 PM Subject: Re: [Pharo-project] How to encrypt a password? On Wed, Oct 26, 2011 at 5:54 PM, John Toohey <jt@parspro.com> wrote: Off topic, but is the use of a .pharoconf file documented somewhere? No at all. Pharo does know nothing about it. It is just a plain file you can create and read stuff from there...just as any other file in any other language :) On Wed, Oct 26, 2011 at 05:12, Francois Stephany <tulipe.moutarde@gmail.com> wrote: >> But I didn't want to put such password in the code... at >> the end what I did (because my scenario is really stupid and only for >> me), is to read the password from a file in my machine :) hahahahha >> > > That would be the kind of thing that belongs to a .pharoconf file in your > /home directory ;) > > -- ~JT -- Mariano http://marianopeck.wordpress.com
I guess the next question then, is it possible to define variables via the VM command line, as with the Java VM, i.e. -Dhome=/home/cat and have a properties class that make these available to the applications. On Wed, Oct 26, 2011 at 12:05, Mariano Martinez Peck <marianopeck@gmail.com> wrote:
On Wed, Oct 26, 2011 at 5:54 PM, John Toohey <jt@parspro.com> wrote:
Off topic, but is the use of a .pharoconf file documented somewhere?
No at all. Pharo does know nothing about it. It is just a plain file you can create and read stuff from there...just as any other file in any other language :)
On Wed, Oct 26, 2011 at 05:12, Francois Stephany <tulipe.moutarde@gmail.com> wrote:
But I didn't want to put such password in the code... at the end what I did (because my scenario is really stupid and only for me), is to read the password from a file in my machine :) Â hahahahha
That would be the kind of thing that belongs to a .pharoconf file in your /home directory ;)
-- ~JT
-- Mariano http://marianopeck.wordpress.com
-- ~JT
participants (5)
-
Francois Stephany -
Gary Chambers -
John Toohey -
Mariano Martinez Peck -
mkobetic＠gmail.com