Flask-security: Enable bcrypt as default encryption setting

[caseydm]

Flask-security currently stores passwords in plaintext by default. My fear is that others like me did not notice this behavior, as the only reference to it is a note in the configuration section saying 'Defaults to plaintext'.

From researching it sounds like bcrypt is the best available option. I recommend either bundling bcrypt in the install and enabling as the default encryption setting, or adding an app.config['SECURITY_PASSWORD_HASH'] to the QuickStart page in the documentation.

[WilliamMayor]

I noticed in #244 that there's a reluctance to make a decision on behalf of the developer here. I understand that, but I think that having plaintext be the default is frighteningly dangerous. Perhaps the default behaviour can be to raise an exception unless an encryption scheme is picked?

If that's not reasonable then the fact that the default is plaintext needs to be screamed at the developer when they're reading the docs.

[jirikuncar]

@WilliamMayor I would go for a warning (see https://github.com/jirikuncar/flask-security/commit/2309c20455862e7d0dd30a4d4053eb7bdd6145a6).

[WilliamMayor]

Warnings seem a little too light-touch for me. Password security is a serious thing and I don't think it should be possible for developers to make objectively bad decisions. Not wanting to pick which good decision to make, that's fine.

[jirikuncar]

@WilliamMayor there is already a recommendation for bcrypt in docs. IMHO the warning seems like a good compromise if no option is set for a beginning.

[WilliamMayor]

@jirikuncar But why let people shoot themselves in the foot this badly? There's no benefit to plaintext passwords and barely any work required to set up hashed ones. Why have a default that makes this security library insecure?

[jirikuncar]

@WilliamMayor I don't have strong opinion about it. I see benefits in both (a) having good defaults (b) educating users about configuration. I can change the default password hash for Flask-Security-Fork if you think it will help.

[WilliamMayor]

What's Flask-Security-Fork? Would it help? Which code is installed when you pip install Flask-Security? I assumed this repo?

[jirikuncar]

@WilliamMayor we are maintaining a fork with many (security and other) patches applied. It would be nice to have more secure defaults there.

[jacquerie]

FYI Flask-Security-Fork is now using bcrypt by default: https://github.com/inveniosoftware/flask-security-fork/pull/32.

[jirikuncar]

Closed via 510d1356