Password hash reuses global salt

Code reviewSecurityAlgorithms & data structuresMid–Senior~20 min

Review this Python user-auth code.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1import hashlib, hmac, os

3SALT = os.environ['PW_SALT'] # one global salt

5def hash_pw(password: str) -> str:

6 return hashlib.sha256((SALT + password).encode()).hexdigest()

8def check_pw(password: str, stored: str) -> bool:

9 return hash_pw(password) == stored

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.