In fact, the one-way hash functions (MD5, SHA-1, SHA-256/512, ...) are not for password encryption, they are for computing a digest of messages in order to ensure their integrity. These functions usually suffer of recognizability and of computing speed and hence they cannot be used to encrypt passwords. To encrypt passwords, some features are added to these well-known hash functions in order to generate more entropy in the computing of the digest: salting and stretching. For example, the algorithms used in the Unix systems are variations of MD5 and of SHA-256/512 using these two techniques. In another way, in effect, there is a family of cryptographic algorithms that is more suited to encrypt the passwords: the adaptive key derivation functions in which we can find bcrypt but also PBKDF2 and scrypt. (OpenBSD, an operating system obsessed with security, uses bcrypt as its default authentication mechanism). Beside the cryptographic functions for passwords, there is also some recommendations to follow. Among them: - prefer passphrases to passwords: the user can more easily remember them and they add inherently more of entropy, - for each authentication failure, multiply by 2 or more the time between two retries. Miguel Le 02/02/2013 18:33, Paul DeBruicker a écrit :
I guess it depends on the cost to you or your organization of having someone you don't want/know getting access to information that should be password protected.
A thorough argument for bcrypt rather than md5/SHA is made here:
http://codahale.com/how-to-safely-store-a-password/
I use it because for roughly the same number of lines of code passwords are much harder to crack.
On 02/02/2013 09:02 AM, Benjamin wrote:
Why not just something like
| password cryptedPassword |
password := UITheme current passwordEntryIn: World text: 'Password' title: 'Title' entryText: ''. cryptedPassword := MD5 new initialize hashStream: password readStream
?
Ben
On Feb 2, 2013, at 5:06 PM, Paul DeBruicker <pdebruic@gmail.com <mailto:pdebruic@gmail.com>> wrote:
For an example of the login process using Pharo + Seaside see
http://www.squeaksource.com/TFLogin
Which you can probably adapt for just Pharo
To store the passwords, if you're on linux, use the bcrypt implementation in the PasswordHashingFFI package from here:
http://www.squeaksource.com/Cryptography.html
I'd be interested in getting PasswordHashingFFI working on Windows or MacOSX so would help if I can. But using it makes your implementation depend upon an external library you'd likely have to find and supply for users.
On 02/01/2013 03:36 PM, J. P. L. MartÃn wrote:
Hello people, I'm making a Practical Work in Pharo with my classmates, the Work should be a fully working application to manage a University Library. At the moment we have most of the work done, I must say it's messy and far from being beautiful, but it works and it's likely to be approved. Here is what's done so far: https://github.com/arguser/Paradigmas-Final
Most of the work was doing making research and guided mostly y examples, so far I didn't find how to do or make work some features: * A Dialog which prompts for User and Password (We don't know how to implement it in-code either) * Block a father window when a child is made, so the father window can't be closed if a child window exist. * Make some content of windows change size dynamically. * Search only for filled-in fields from search form.
If any advice or example can be given addressing the previous matters it will be really helpful.
Thanks in advance!
--