Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm not an expert in any sense, just a Django user. I've never actually looked under the hood, since it just works.

You specify an order of the hash algorithms, putting the one you want first. Switching to bcrypt for me was just a matter of moving it up a few lines in a list.

The password field can probably stay the same length, since it is a hash value anyway. I'm assuming you have a second field that stores the hash algorithm used. When it logs you in, it uses the current algorithm to authenticate you. Then if that technique isn't first on your list, it creates a new, salted hash, and stores both that and the new hash type in the database. Nice and slick.



thanks for the insight, much appreciated. never really thought about how to do this before. (screams for a 'website security patterns' book.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: