Question

So when building a webapp and storing passwords, both security and performance are important things to keep in mind. Having seen evidence that even salted SHA1 passwords can be easily cracked due to the increasing speed of GPUs, I was wondering what are the best practices of storing passwords.

I thought that in order to add more security to storing passwords, you could add a secret to the salt. So for instance, the python code for this could be:

import hashlib
import hmac

secret = 'XYZ'
h = hmac.new('salt' + secret, 'password')

• Is this a common thing to do?
• What are the drawbacks of this?
• What are the best practices in this field?

P.S. I didn’t post this in the security forum because I want a webapp developer’s perspective.

Answer 1

Also have a look at passlib: http://pypi.python.org/pypi/passlib/