[web2py] Re: password hash problems

2010-02-07 Thread mdipierro
remember that validators are filters. You need to check that a password is strong BEFORE it is hashed. So instead of this: auth.settings.table_user.password.requires += [IS_STRONG(min=8, max=0, upper=1, lower=1, number=1, special=1)] Do this

[web2py] Re: password hash problems

2010-02-07 Thread mr.freeze
Looking at CRYPT, if you provide a key but not a digest algorithm, it will try to get the digest alg by splitting the key between a colon. So you could say: auth.settings.hmac_key = 'sha512:%s' % vpepm_hmac_key On Feb 7, 1:44 pm, Jonathan Lundell jlund...@pobox.com wrote: I've got this (where

Re: [web2py] Re: password hash problems

2010-02-07 Thread Jonathan Lundell
On Feb 7, 2010, at 12:10 PM, mr.freeze wrote: Looking at CRYPT, if you provide a key but not a digest algorithm, it will try to get the digest alg by splitting the key between a colon. So you could say: auth.settings.hmac_key = 'sha512:%s' % vpepm_hmac_key That did the trick. Thanks, I

Re: [web2py] Re: password hash problems

2010-02-07 Thread Jonathan Lundell
On Feb 7, 2010, at 12:07 PM, mdipierro wrote: remember that validators are filters. You need to check that a password is strong BEFORE it is hashed. So instead of this: auth.settings.table_user.password.requires += [IS_STRONG(min=8, max=0, upper=1, lower=1, number=1, special=1)] Do this

Re: [web2py] Re: password hash problems

2010-02-07 Thread Jonathan Lundell
On Feb 7, 2010, at 12:07 PM, mdipierro wrote: remember that validators are filters. You need to check that a password is strong BEFORE it is hashed. So instead of this: auth.settings.table_user.password.requires += [IS_STRONG(min=8, max=0, upper=1, lower=1, number=1, special=1)] Do this

[web2py] Re: password hash problems

2010-02-07 Thread mdipierro
oops. yes. On Feb 7, 2:35 pm, Jonathan Lundell jlund...@pobox.com wrote: On Feb 7, 2010, at 12:07 PM, mdipierro wrote: remember that validators are filters. You need to check that a password is strong BEFORE it is hashed. So instead of this: auth.settings.table_user.password.requires