+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Python] Python "Secure Login" system [SHA 256] (/showthread.php?tid=3238803)
Pages: Pages
1
2
Python "Secure Login" system [SHA 256] - ノクス。 - Feb 7, 2013
So I've been seeing numerous login system out there and it's not cutting the security needed. So here's my version of a login system.
Fine, here's the more secure version.
Code
import hashlib
import getpass
class login():
def __init__(self, usrData):
self.userdat = userdata;
def md(self, string):
return hashlib.sha224(string).hexdigest();
def login(self):
userName = raw_input("Username: ");
passWord = getpass.getpass("Password: ");
dataStream = open(userData);
for i in dataStream.readlines():
if md(username+password.split("\n")[0]) == i:
return 1;
print "Invalid Credentials";
return 0;
def makeLogin(self):
print "New user"
userName = raw_input("Username: ");
passWord = raw_input("Password: ");
dataStream = open(userData, "w");
dataSteam.writelines(md(username+password))
print "New User Successful."The login.login() function returns '1' if the user credentials is true.
And it doesn't echo the password now.
* - xanthar - Feb 7, 2013
This is a better version. But maybe a better hash algorithm like sha-256 could be used instead for further security measures..
Maybe even check out scrypt - a new key deriviation function(2009). http://www.tarsnap.com/scrypt/scrypt-slides.pdf
* - ~Dec - Feb 7, 2013
MD5 is nowhere near secure anymore. I recommend you use bcrypt. Scrypt is good too, it's quite similar to bcrypt - but bcrypt is my preferred choice. I recommend you read this: http://codahale.com/how-to-safely-store-a-password/
* - K.ing - Feb 7, 2013
I like the implementation, will look into stronger encryption.
* - PigBacon - Feb 7, 2013
You're using raw_input() for the password.
Whelp, I won't be using your security related applications.
* - ノクス。 - Feb 7, 2013
(Feb 7, 2013 03:12 AM)plausibility Wrote: You're using raw_input() for the password.
Whelp, I won't be using your security related applications.
Seriously, anyone with a few brain cells can use the 'password' module of python and implement that. I'm just too lazy to type it.
And yeah, I have a modified version that uses RGV's to hash a password and do some decryption.
* - Rhynorater. - Feb 7, 2013
(Feb 7, 2013 04:20 AM)-Defy Wrote: Seriously, anyone with a few brain cells can use the 'password' module of python and implement that. I'm just too lazy to type it.Lazy programming leads to security issues.
And yeah, I have a modified version that uses RGV's to hash a password and do some decryption.
-Rhynorater.
* - -Max - Feb 7, 2013
The md5 module is depreciated, use hashlib. Also, MD5 isn't very secure anymore unfortunately, use sha256. Finally, use getpass...
Good day!
* - ノクス。 - Feb 7, 2013
(Feb 7, 2013 09:24 AM)ℛhynorater. Wrote: Lazy programming leads to security issues.
-Rhynorater.
It's for the community. I'm not even using it anymore. Fine, since you guys are so anal.
* - Djаngo - Feb 7, 2013
(Feb 7, 2013 03:12 AM)plausibility Wrote: You're using raw_input() for the password.
Whelp, I won't be using your security related applications.
This literally made me lol. You do know that raw_input doesn't accept code input just reads, interprets everything passed to it, and does no checks.
EDIT: Unless you're talking about getpass which is literally just like linux but even then raw_input is the same just shows the characters typed. In which the OP uses in his code.
* - ノクス。 - Feb 7, 2013
(Feb 7, 2013 07:18 PM)anonym00se Wrote: This literally made me lol. You do know that raw_input doesn't accept code input just reads, interprets everything passed to it, and does no checks.
EDIT: Unless you're talking about getpass which is literally just like linux but even then raw_input is the same just shows the characters typed. In which the OP uses in his code.
Yes, he means getpass. since the source is merely an example not the real code.
* - Djаngo - Feb 7, 2013
(Feb 7, 2013 07:41 PM)-Defy Wrote: Yes, he means getpass. since the source is merely an example not the real code.
Either way raw_input is not "Unsecure" compared to input.
* - PigBacon - Feb 8, 2013
(Feb 7, 2013 07:18 PM)Baus Wrote: This literally made me lol. You do know that raw_input doesn't accept code input just reads, interprets everything passed to it, and does no checks.
EDIT: Unless you're talking about getpass which is literally just like linux but even then raw_input is the same just shows the characters typed. In which the OP uses in his code.
I meant because he's not using getpass, which is the very minimum I'd want for typing anything semi-credential-wise into a program.
* - Djаngo - Feb 8, 2013
(Feb 8, 2013 05:30 PM)plausibility Wrote: I meant because he's not using getpass, which is the very minimum I'd want for typing anything semi-credential-wise into a program.
Raw input and getpass are basically the same it's just getpass doesn't show the text. I literally was thinking you were saying raw input was bad 🤫
time to change my sig
* - PigBacon - Feb 8, 2013
(Feb 8, 2013 05:39 PM)Baus Wrote: Raw input and getpass are basically the same it's just getpass doesn't show the text. I literally was thinking you were saying raw input was bad 🤫
time to change my sig
I know they're the same, I just mean if what I type is going to be in my term until I close it, or someone could do the whole look-over-the-shoulder or I could accidentally broadcast it or something.
Even your sudo password can be spied on, but I'd still prefer to not have my password written for everyone to see by scrolling up.