Should we use passlib?

[Christopher Allan Webber]

Currently we use py-bcrypt for python password hashing.

`http://code.google.com/p/py-bcrypt/ <http://code.google.com/p/py-bcrypt/>`_

Should we use passlib?

`http://packages.python.org/passlib/ <http://packages.python.org/passlib/>`_

My main thought is, "Which of these libraries has more users and is
more likely to stay around while remaining secure?"

[Christopher Allan Webber]

::

    <aleksm> for #369, passlib also has bcrypt so the only thing that separates
             them apart is the community, and I'm willing to bet that passlib has
             more users

Looking again at it:

::

    It will use the first available of two possible backends:
    
        py-bcrypt, if installed.
        stdlib crypt(), if the host OS supports BCrypt.
    
    You can see which backend is in use by calling the get_backend() method.

`http://packages.python.org/passlib/lib/passlib.hash.bcrypt.html?highlight=bcrypt#passlib.hash.bcrypt <http://packages.python.org/passlib/lib/passlib.hash.bcrypt.html?highlight=bcrypt#passlib.hash.bcrypt>`_

[Christopher Allan Webber]

Marking as closed because I think the answer is safely either "no
or not yet, since they use the same library we do anyway for
bcrypt."

[Will Kahn-Greene]

The original url for this bug was ​http://bugs.foocorp.net/issues/369 .