Password storage best practices in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

Why should passwords never be stored in plain text?

Storing passwords in plain text is dangerous because if the database is hacked, attackers get direct access to user passwords. This can lead to account theft and further security breaches.

beginner

What is hashing in the context of password storage?

Hashing is a one-way process that converts a password into a fixed-length string of characters. It is designed so you cannot reverse it to get the original password, making it safer to store.

intermediate

What role does a salt play in password hashing?

A salt is a random string added to a password before hashing. It ensures that even if two users have the same password, their hashes will be different, protecting against attacks using precomputed tables.

beginner

Which Python library is recommended for secure password hashing in Flask?

The 'werkzeug.security' module is recommended in Flask. It provides functions like generate_password_hash() and check_password_hash() to safely hash and verify passwords.

intermediate

Why is using a slow hashing algorithm important for password storage?

Slow hashing algorithms make it harder for attackers to try many password guesses quickly. This reduces the risk of brute-force attacks and improves security.

Which of the following is the safest way to store passwords in a Flask app?

A Hash passwords using SHA-1 without salt

B Use werkzeug.security's generate_password_hash with salt

C Store passwords as plain text in the database

D Encrypt passwords with reversible encryption

Using werkzeug.security's generate_password_hash adds salt and uses a strong hashing algorithm, making it the safest option.

What does adding a salt to a password hash prevent?

A Rainbow table attacks

B Password length issues

C Password reuse by users

D Database connection errors

Salts prevent rainbow table attacks by making each hash unique, even for identical passwords.

Which function in Flask's Werkzeug library checks if a password matches its hash?

A verify_password()

B validate_password()

C check_password_hash()

D compare_hash()

check_password_hash() compares a stored hash with a password attempt securely.

Why should password hashing algorithms be slow?

A To make brute-force attacks slower

B To save server resources

C To speed up user login

D To reduce password length

Slow hashing algorithms increase the time needed for each guess, making brute-force attacks less practical.

What is a common hashing algorithm used by generate_password_hash in Flask?

A MD5

B SHA-256

C Base64

D PBKDF2

generate_password_hash uses PBKDF2 by default, which is a slow and secure hashing algorithm.

Explain the steps you would take to securely store user passwords in a Flask application.

Think about how to protect passwords from attackers if the database is leaked.

Describe why salting passwords is important and how it improves security.

Consider what happens if two users have the same password.