Member Avatar for gabec94

Hi I am trying to write a function password_input(prompt, password) that will repeatedly ask for a password using the given prompt until the given password is entered. I have testing code, but I am completely lost upon how to do it and where to begin.
This is the testing code:

password_input(“Enter your password: “,”dromedary”)
print “Welcome to my computer!”

I know that I have to use a while loop to keep checking the password, but thats about it.
Any help is appreciated, thanks a lot!

  • 4 Contributors
  • 4 Replies
  • 138 Views
  • 3 Months Discussion Span
  • Latest Post Latest Post by Flameass

Dani AI

Generated

A loop that keeps asking until the expected value is entered is the right core idea (as demonstrated). For a small script that only needs simple protection, hide the typed password so it is not echoed and return when the input matches the expected value. For anything beyond a throwaway script, avoid storing plaintext in code and use a salted, slow key-derivation function.

Simple, non-production example that reads a hidden password and repeats until it matches a given secret:

import getpass

def password_input(prompt, password):
    while True:
        if getpass.getpass(prompt) == password:
            return

A more robust approach derives a stored key and compares it in constant time to avoid timing attacks. The example below uses PBKDF2 and a safe compare; store the salt and derived value outside the source (config file, DB, env):

import getpass, hashlib, hmac, binascii

def password_input(prompt, salt, stored_hex, iterations=100000):
    while True:
        pwd = getpass.getpass(prompt).encode('utf-8')
        key = hashlib.pbkdf2_hmac('sha256', pwd, salt, iterations)
        if hmac.compare_digest(binascii.hexlify(key).decode('ascii'), stored_hex):
            return

Notes and cautions:

  • Bare fast hashes are weak against brute force and precomputed attacks (as and hinted). Prefer PBKDF2/scrypt/bcrypt/Argon2 for real systems.
  • Use a unique random salt (os.urandom) per password and keep salts with the stored hash.
  • For production use, rely on well-maintained libraries such as Passlib or a vetted system auth mechanism rather than rolling a custom scheme. See the Python docs for getpass, pbkdf2_hmac, and hmac.compare_digest for details: getpass docs, hashlib.pbkdf2_hmac docs, hmac.compare_digest docs.

Recommended Answers

All 4 Replies

Member Avatar for BearofNH

This will get you started, but there are many things you need to consider beyond the core function.

def password_input(prompt, pw):
    while True:   # Forever
        data = raw_input(prompt)
        if data == pw:
            return

The key routine raw_input() is no longer recommended, but I've forgotten the replacement riff.

Member Avatar for gabec94

thanks a ton BearofNH I figured out the rest

Member Avatar for mn_kthompson

You might want to look at using hashlib so that your password function is more secure. For example, someone could examine the plaintext of your python and find out what the password is. An easy way to get around this is to use a hashing function like SHA1 to encrypt your password. Then you prompt the user for a password and encrypt it too. Finally, you check if the two encrypted password match. Nobody can reverse engineer your password from your code.

import hashlib

# Here we put the expected value of our password.
# The plaintext of this string is password.
known_good = '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8'

user_supplied = hashlib.sha1(raw_input('Password: ')).hexdigest()

if known_good == user_supplied:
  print Good
else:
  print bad
Member Avatar for Flameass

You might want to look at using hashlib so that your password function is more secure. For example, someone could examine the plaintext of your python and find out what the password is. An easy way to get around this is to use a hashing function like SHA1 to encrypt your password. Then you prompt the user for a password and encrypt it too. Finally, you check if the two encrypted password match. Nobody can reverse engineer your password from your code.

import hashlib

# Here we put the expected value of our password.
# The plaintext of this string is password.
known_good = '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8'

user_supplied = hashlib.sha1(raw_input('Password: ')).hexdigest()

if known_good == user_supplied:
  print Good
else:
  print bad

The problem with your technique is that I know your know_good password is the value 'password'.

See http://en.wikipedia.org/wiki/Rainbow_tables

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.