What’s the most secure possible Devise configuration?

Peppers: yes you are correct. There is not much additional security achieved with a pepper if you are using salt. Stretches: 12 is reasonable, however bcrypt only ensures a constant time. You should consider using the newer scrypt as it allows you to specify both a constant time and the amount of memory to use. … Read more

Trying to hash a password using bcrypt inside an async function

await dosent wait for bcrypt.hash because bcrypt.hash does not return a promise. Use the following method, which wraps bcrypt in a promise in order to use await. async function hashPassword (user) { const password = user.password const saltRounds = 10; const hashedPassword = await new Promise((resolve, reject) => { bcrypt.hash(password, saltRounds, function(err, hash) { if … Read more

Why do I get a bcrypt-ruby gem install error?

I had the same problem installing under OSX 10.7.3. When installing the gem, my error message was: Building native extensions. This could take a while… ERROR: Error installing bcrypt-ruby: ERROR: Failed to build gem native extension. creating Makefile make compiling bcrypt_ext.c make: /usr/bin/gcc-4.2: No such file or directory make: *** [bcrypt_ext.o] Error 1 Looks like … Read more

bcrypt.checkpw returns TypeError: Unicode-objects must be encoded before checking

I make the assumption that you use Python 3. With Python 3, strings are, by default, unicode strings. If you call the bcrypt.checkpw() function with unicode values: import bcrypt password = “seCr3t” # unicode string hashed_password = “hashed_seCr3t” # unicode string bcrypt.checkpw(password, hashed_password) You’ll get this exception Traceback (most recent call last): … TypeError: Unicode-objects must be … Read more