Should we use passlib?

[Christopher Allan Webber]

Currently we use py-bcrypt for python password hashing.

http://code.google.com/p/py-bcrypt/

Should we use passlib?

http://packages.python.org/passlib/

My main thought is, "Which of these libraries has more users and is more likely to stay around while remaining secure?"

[Christopher Allan Webber]

<aleksm> for #369, passlib also has bcrypt so the only thing that separates
         them apart is the community, and I'm willing to bet that passlib has
         more users

Looking again at it:

It will use the first available of two possible backends:

    py-bcrypt, if installed.
    stdlib crypt(), if the host OS supports BCrypt.

You can see which backend is in use by calling the get_backend() method.

http://packages.python.org/passlib/lib/passlib.hash.bcrypt.html?highlight=bcrypt#passlib.hash.bcrypt

[Christopher Allan Webber]

Marking as closed because I think the answer is safely either "no or not yet, since they use the same library we do anyway for bcrypt."

[Will Kahn-Greene]

The original url for this bug was ​http://bugs.foocorp.net/issues/369 .