Use bcrypt for storing passwords

[jedireza]

Use bcrypt for storing passwords

[hfiguiere]

crate is fine as it does what is mostly advertised and documented (this is a very weak point of that crate). As mentioned above pwhash is a crate that does what we want, that uses rust-crypto as an crypto implementation.

I'm about to submit a PR that implement bcrypt() as password hashing.

[jedireza]

FYI: The crate we're using, rust-crypto, supports this.

[hfiguiere]

"support" with air quotes.

[hfiguiere]

but there is the crate pwhash that should provide what is need, and it uses rust-crypto.

[jedireza]

@hfiguiere I'm not sure what you mean by:

"support" with air quotes.

I didn't dig into it myself, but the list of supported algorithms included bcrypt. Does it not actually do bcrypt hashing? Are there known issues with this crate?

Also, we're using rust-crypto in foxbox/src/stable_uuid.rs. If there is an issue with this crate we should call it out in that repo too.

[hfiguiere]

Just to clarify what I said earlier in better terms. rust-crypto supports bcrypt as a cypher. pwhash implements password hashing using, amongst other things, bcrypt as implemented by rust-crypto, following the standard hash format.

[ferjm]

Closed by #71