Path: csiph.com!usenet.pasdenom.info!dedibox.gegeweb.org!gegeweb.eu!nntpfeed.proxad.net!proxad.net!feeder1-2.proxad.net!usenet-fr.net!nerim.net!novso.com!newsfeed.xs4all.nl!newsfeed2.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: OK 0.044 X-Spam-Evidence: '*H*': 0.91; '*S*': 0.00; 'advice.': 0.09; 'security.': 0.09; 'dec': 0.15; '(python)': 0.16; '8:40': 0.16; 'encryption': 0.16; 'gmail.': 0.16; 'layers.': 0.16; 'overriding': 0.16; 'smtplib': 0.16; 'subject:Password': 0.16; 'tls': 0.16; 'wrote:': 0.17; "shouldn't": 0.17; 'module': 0.19; 'monday,': 0.23; 'script': 0.24; 'header:In-Reply-To:1': 0.25; 'guess': 0.27; 'plain': 0.27; 'message-id:@mail.gmail.com': 0.27; 'hash': 0.29; 'usually': 0.30; 'waste': 0.30; 'december': 0.32; 'implement': 0.32; 'to:addr:python-list': 0.33; 'another': 0.33; 'received:google.com': 0.34; 'server': 0.35; 'data,': 0.35; 'robert': 0.35; 'smtp': 0.35; 'text.': 0.35; 'pm,': 0.35; 'received:209.85.220': 0.35; 'received:209.85': 0.35; 'wanted': 0.36; 'available.': 0.37; 'bad': 0.37; 'does': 0.37; 'two': 0.37; 'uses': 0.37; 'rather': 0.37; 'received:209': 0.37; 'data': 0.37; 'subject:: ': 0.38; 'comment': 0.38; 'mean': 0.38; 'supports': 0.38; 'some': 0.38; 'login': 0.38; 'to:addr:python.org': 0.39; 'application': 0.40; 'header:Received:5': 0.40; 'think': 0.40; 'your': 0.60; 'techniques': 0.63; 'details': 0.63; 'account': 0.67; 'believe': 0.69; 'fact,': 0.69; 'yourself': 0.77; 'montgomery': 0.84; 'to:name:python': 0.84 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; bh=9guqbE/RIK8SKGY7bHwE06Xh8JaGAp09HBIE8/sWPbY=; b=ZfQa/p+SMAsF+tzFLw9DczjVZG9gLr0rRl1CNH+l8gcO5jQ2cGFtIEbonX+81+KnJv vDLJQ78deA++UCYGXNRcyj9DwEN2arlSfEacJcvOXtRoSXvPmV7G2NeQCtAp8P2VHlbp 8IemEPf+fJsGZaJ86yh/ARyyk/yZtSEJ0soBZb9vCc3dXh67WWA6+UHSHXtrJSFBGkMx iJuNhmteP7HxzX1vWD1RAIsatkb+IWpmjb78aBEzyuudaiZBL3Pj/QFXJDQ7u9LvjhxY rdDSfml2Trmpp07YplWBe0QrguaQlE+L0mAuMo7MHx2TcdHBxCmskZBL97GRL4P1b4Cy 5j/w== MIME-Version: 1.0 In-Reply-To: <61c744f6-d3a6-46d6-9e03-775e22b763a3@googlegroups.com> References: <61c744f6-d3a6-46d6-9e03-775e22b763a3@googlegroups.com> From: Ian Kelly Date: Wed, 26 Dec 2012 13:16:41 -0700 Subject: Re: Password hash To: Python Content-Type: text/plain; charset=ISO-8859-1 X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Newsgroups: comp.lang.python Message-ID: Lines: 23 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1356553042 news.xs4all.nl 6958 [2001:888:2000:d::a6]:58698 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:35539 On Tue, Dec 25, 2012 at 8:40 PM, Ramchandra Apte wrote: > On Monday, 24 December 2012 08:08:12 UTC+5:30, Robert Montgomery wrote: >> I am writing a script that will send an email using an account I set up >> >> in gmail. It is an smtp server using tls on port 587, and I would like >> >> to use a password hash in the (python) script for login rather than >> >> plain text. Is this do-able? Details please. > > No. The password is encrypted with TLS I think so I believe you shouldn't worry much about security. The smtplib module automatically uses CRAM-MD5 for authentication if it is available. If you wanted to use some other hashing scheme then I guess you would have to implement it yourself by overriding SMTP.login, or find another SMTP module that already supports it. The above comment about security is bad advice. Security is all about layers. Just because the data stream is already encrypted (read: decryptable) does not mean that password digests are a waste of time. In fact, the two techniques are usually considered complementary: the encryption process protects your application data, while the password hashing protects your authentication details.