问题描述

我有一个小型 python 程序，将由一小群人(<15 人)在本地使用.但为了问责，我想在程序开始时进行简单的用户名+密码检查(不't需要超级安全).供您参考，我只是一个初学者，这是我第一次尝试它.当我四处搜索时，我发现python有用于加密的passlib.但即使在看了之后，我仍然不确定如何实现我的加密.所以，我想知道一些事情.

I have a small python program which will be used locally by a small group of people (<15 people).But for accountability, i want to have a simple username+password check at the start of the program ( doesn't need to be super secure).For your information, I am just a beginner and this is my first time trying it.When i search around, i found that python has passlib for encryption. But even after looking though it i am still not sure how to implement my encryption.So, there are a few things that i want to know.

1. 如何在本地存储用户的密码?我目前知道的唯一方法是创建一个文本文件并从中读取/写入，但这会破坏加密的整个目的，因为人们可以打开文本文件并从那里读取它.
2. hash & 是什么意思?盐意味着加密，它是如何工作的?(简单的解释就可以了.)
3. 实施用户名和密码检查的推荐方法是什么?

对于这些愚蠢的问题，我深表歉意.但如果您能回答我的问题，我将不胜感激.

I am sorry for the stupid questions. But i will greatly appreciate if you could answers my question.

推荐答案

import getpass
import pickle
import hashlib
from os import path

def Encryption(data):
    return hashlib.sha512(data).hexdigest()

## First we check if the database exists.
if path.isfile('database.db'):
    with open('database.db', 'rb') as fh:
        db = pickle.load(fh)

## If it doesn't, we will create one.
else:
    ## First we create the desired variable.
    db = {'torxed' : Encryption('wham'), 'someoneelse' : Encryption('pass')}
    ## Then we open a filehandle to it.
    with open('database.db', 'wb') as fh:
        ## And then we dump the variable into the filehandle.
        ## This will keep the variable intact between sessions,
        ## meaning the next time you start your script, the variable will look the same.
        pickle.dump(db, fh)


## Then we ask the user for his/hers credentials.
user = raw_input('Username: ')
_pass = getpass.getpass('Password: ')

## If the user exists in the "db" and the decoded password
## Matches the logged in user, it's a-ok :)
if user in db and db[user] == Encryption(_pass):
    print('You logged in')

添加更多用户

import pickle, hashlib

def Encryption(data):
    return hashlib.sha512(data).hexdigest()

with open('database.db', 'rb') as fh:
    db = pickle.load(fh)

db['new_user'] = Encryption('password')

with open('database.db', 'wb') as fh:
    pickle.dump(db, fh)

另一种方法是在添加用户时使用 sys.argv 从命令行获取用户名和密码，在这种情况下:

Another way would be to use sys.argv to get the username and password from the commandline when addings users, in that case:

import pickle, hashlib, sys
if len(sys.argv) < 3:
    raise ValueError('Need two parameters, username and password')

def Encryption(data):
    return hashlib.sha512(data).hexdigest()

with open('database.db', 'rb') as fh:
    db = pickle.load(fh)

db[sys.argv[1]] = Encryption(sys.argv[2])

with open('database.db', 'wb') as fh:
    pickle.dump(db, fh)

我应该扩展这个答案并解释你应该 salt 密码 也是如此，而不仅仅是使用 SHA 哈希来存储它们.

I should expand on this answer and explain that you should salt passwords as well, and not just store them with a SHA hash.

另请注意，密码严格来说是不安全的".当存储在内存中时，因为没有 SecureString (更多)在写这篇文章时.但出于基本目的，这个答案仍然适用.

Also note that passwords are strictly speaking "unsafe" when stored in memory, as there is no SecureString (more) in Python as of writing this. But for basic purposes this answer still applies.

这篇关于密码保护 Python的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持跟版网！