Code reviewMediumcr-g032

Subject Crypto misuseLevel Mid–Senior~20 minCommon in Security · Algorithms & data structures interviewsIndustries Software development

Question

Review this Python user-auth code.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewpython

1import hashlib, hmac, os2 3SALT = os.environ['PW_SALT']  # one global salt4 5def hash_pw(password: str) -> str:6    return hashlib.sha256((SALT + password).encode()).hexdigest()7 8def check_pw(password: str, stored: str) -> bool:9    return hash_pw(password) == stored

Run or narrate your approach, then ask the coach.