App Engine：传输密码并将其安全存储在 Google App Engine 中的最佳做法是什么？
I'm wondering what is the state-of-the-art of transmitting passwords from a web form and storing them in the data store.
A lot of recent posts point to bcrypt, however, there are no pure Python implementations, which is a requirement for App Engine.
Any suggestions?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
最佳实践？将 Users API 与 Google 帐户或 OpenID 结合使用，这样您就不会首先存储或传输密码。
如果您必须自己执行此操作，请通过 SSL 传输登录数据，并存储经过哈希处理、加盐和强化的< /a>，使用诸如 PBKDF2 之类的方案。
Best practice? Use the Users API with either Google Accounts or OpenID, so you're not storing or transmitting passwords in the first place.
If you must do it yourself, transmit the login data over SSL, and store the password hashed, salted, and strengthened, using a scheme such as PBKDF2.
您可以使用已移植到 google-app- 的 PyCrypto引擎。
当然，您永远不应该存储实际的密码。存储哈希值应该足够了。当用户输入密码时，您将再次对其进行哈希处理并将其与存储的值进行比较。
当然，您应该只通过 https 接收密码，这在 google-app-engine 中受支持（尽管
You can use PyCrypto which has been ported to google-app-engine.
You should never store the actual passwords, of course. Storing a hash should be sufficient. When the user enters his password, you hash it again and compare it to the stored value.
You should of course only receive passwords over https, which is supported in google-app-engine (albeit only through you appspot domain)
BCrypt 不久前已移植到 Python。从那时起我就一直优雅地使用它。
BCrypt has been ported to Python some time ago. I've been using it gracefully since then.