search

aaronrenner / phx_gen_auth

An authentication system generator for Phoenix 1.5 applications.
772 stars 55 forks source link

Use argon2 as default over bcrypt. #118

Closed 7hoenix closed 3 years ago

7hoenix commented 3 years ago

Why is this change necessary?

When this generator was first created Bcrypt was still the OWASP recommended default choice https://github.com/dashbitco/mix_phx_gen_auth_demo/pull/1#discussion_r403110955

That has since changed and argon2 is now the officially recommended choice, with bcrypt only being recommended if argon2 is not available.

This PR swaps the default from bcrypt to argon2.

Should we also default Windows to argon2? <- I don't know and so I left it.

I generated a sample phx project and configured it to look at this local copy of phx_gen_auth. Screen Shot 2021-04-22 at 7 08 44 AM Ran the command with no `hashing-lib` specified. Screen Shot 2021-04-22 at 7 09 02 AM It uses argon2 lib. Screen Shot 2021-04-22 at 7 10 24 AM The tests are green.
josevalim commented 3 years ago

Thank you! We should go ahead with this change indeed. I have added a comment. Also, the build is failing. Can you plaese take a look at the tests?

MaSven commented 3 years ago

As for the windows question. Citate from comeonin

Argon2 is currently considered to be the strongest password hashing function, and it is the one we recommend. Bcrypt and Pbkdf2 are viable alternatives, but they are less resistant than Argon2, to attacks using GPUs or dedicated hardware.

So this superseedes now pbkdf2. Maybe we should also change the default on windows.

aaronrenner commented 3 years ago

Thanks for this PR @7hoenix!. Now that phx_gen_auth has been merged into phoenix 1.6, I'm archiving this project and all phx.gen.auth issues will need to be handled in the phoenix repo.