Introducing the secrets module
Steven D'Aprano
steve at pearwood.info
Sun Apr 17 20:46:55 EDT 2016
On Sun, 17 Apr 2016 10:40 pm, Irmen de Jong wrote:
> On 17-4-2016 4:36, Steven D'Aprano wrote:
>
>> And the documentation:
>>
>> https://docs.python.org/3.6/library/secrets.html
>>
>>
>> Comments requested.
>
> I've read about the "How many bytes should tokens use?" consideration. It
> suggests that to be secure, tokens need to have sufficient randomness. The
> default token length is subject to change at any time to remain secure
> against brute-force. However the API allows you to supply any token
> length, even one that is (a lot) shorter than the default.
> In view of the rationale for this new module ("Python's standard library
> makes it too easy for developers to inadvertently make serious security
> errors") should it perhaps not be allowed to use a value that is less than
> the default?
>
> Hm, perhaps it should not; enforcing this could break code suddenly in the
> future when the default is raised...
Correct.
Also, consider that random tokens are not necessarily for high-security
purposes. Consider Youtube URLs that are intended to be hard to guess and
unpredictable, but permanent:
http://www.youtube.com/watch?v=kQFKtI6gn9Y
There are no security implications from revealing or guessing this URL.
On the other hand:
https://freedom-to-tinker.com/blog/vitaly/gone-in-six-characters-short-urls-considered-harmful-for-cloud-services/
--
Steven
More information about the Python-list
mailing list