The main differences I see are: (note, not an encryption expert either)Michael Engelhart wrote:I agree. Here's some code I use for hashing passwords. Warning - I am not a security or encryption expert so please be aware that this may not be cryptographically secure although I do believe it is much more secure than a plain text file.Uh, I'm not a cryptographer either, so at the risk of sourding uninformed, what's wrong with a two line script like:import sha passwd = 'testing' passwd_hash = sha.new(passwd).hexdigest() Is your version much more secure than straight SHA1?
1) providing an abstract password encryption interface which might have some use beyond just securing the admin password. 2) Adding a salt which basically adds some additional obfuscation for hackers trying to break in. See this link for more info on password salts. http://www.astalavista.com/archive/FAQ/hack-faq/hackfaq-4.html#ss4.6
Using both the username and password to generate the encryption is much better than just the password when you support multiple accounts. Although the current use is just for the admin account, the proposed encryption interface could be used elsewhere.
This raises the question. Could the Webware user management benefit from a general password Encryption interface?
Also, would it make sense to allow UserKit to be used for the Admin access?
