Update auth.py - Githubissues

EFForg / OpenWireless

The official home of the EFF OpenWireless Project

Other

732 stars 80 forks source link

Closed sarciszewski closed 10 years ago

sarciszewski commented 10 years ago

Let's compare hashes in constant-time, for several reasons:

Consistency with CSRF token validation
Paranoia -- could an attacker side-channel our password hash? (Not unless the salt was known.)
Establish a good habit now, as other developers will probably reference EFF projects for examples and inspiration

jsha commented 10 years ago

Reverted for test breakage. See #170.

sarciszewski commented 10 years ago

Hmm, okay, that is definitely strange.