Pbkdf2

[0golovatyi]

• Password hashing is done with PBKDF2
• Added utility to add/update accounts
• Updated documentation

[pep8speaks]

Hello @0golovatyi! Thanks for updating this PR. We checked the lines you've touched for PEP 8 issues, and found:

There are currently no PEP 8 issues detected in this Pull Request. Cheers! :beers:

Comment last updated at 2019-03-28 17:13:39 UTC

[0golovatyi]

@WillAyd Answering your question about how secure is the password file. It is not, and we are aware of it. We are discussing some future improvements where we engage real authentication service instead of implementing our own. What we have here is more for auditing (so TabPy can log what account requested what operation).

However we considered security questions you raised and for now this is what our answer is:

• Using PBKDF2 for hashing makes it significantly harder to recover a password comparing with SHA (times if not powers).
• For the password file, we believe hosting OS mechanisms should be used to restrict access to files with sensitive information. I'll update the documentation with the recommendation.