Blog posts tagged in Secure account information in Python

python-ev.png

Python 3.6, the newest major release of the Python language, has added a new module, called secrets, to help generate cryptographically strong random numbers for managing secrets, like account authentication, tokens and related secrets. Python developers are highly likely to prefer secrets over the default pseudo-random number generator in the random module, since it’s not meant for cryptography or security, but modelling and simulation.

Let’s understand with an example how one can create their own cryptographically strong pseudo-random values and generate tokens using the secrets module.

How to create Cryptographically Strong Pseudo-Random Values using secrets

>>> import secrets
>>> import string
>>> characters = string.ascii_letters + string.digits
>>> secure_password = ''.join(secrets.choice(chNo Records.aracters) for i in range(10))
>>> secure_password
'SRvM54ZAs1'

The first step is to import the secrets and the string modules. Then we create a string of uppercase letters and integers. Now, in order to choose characters randomly to generate a secure password, we need to use the secrets module’s choice() method. The reason it’s being called a secure password is because there’s been a use of mixed case, numbers and symbols in the password, which is highly advised to people to keep their passwords protected from hack attacks.

How to Generate Tokens using secrets

There is not one but several methods to generate tokens using the secrets module. Below are mentioned some examples to ease your learning on token generation using secrets.

>>>: secrets.token_bytes()
b'\xd1Od\xe0\xe4\xf8Rn\xf4G\xdb\x08\xa8\x85\xeb\xba>\x8cO\xa7XV\x1cb\xd6\x11\xa0\xcaK'

>>> secrets.token_bytes(8)
b'\xfc,9y\xbe]\x0e\xfb'

>>> secrets.token_hex(16)
'6cf3baf51c12ebfcbe26d08b6bbe1ac0'

>>> secrets.token_urlsafe(16)
'5t_jLGlV8yp2Q5tolvBesQ'

The token_bytes function here allows to return a random byte string containing nbytes number of bytes. A reasonable default could also be put into use when nbytes is None or not supplied. In the first example, there is no mention of number of bytes, hence Python itself choose a reasonable number there. The token-bytes function was used again, but this time with 8 bytes. The next function used was token_hex, to return a random text string, in hexadecimal. The token_urlsafe function is the last one used there, meant to return a random URL-safe text string. Base64 encoding was also used for text.

Click here to unveil 7 Python libraries to use in 2017

How Many Bytes to Use for Tokens?

You should have sufficient randomness for your tokens to secure them against brute-force attacks. It’s advised that at least 32 bytes (256 bits) of randomness should be used to protect tokens from security breaches.

The Python developer community will see the secrets module as an important addition to Python 3.6. With secrets, Python 3.6 developers now have a reliable way to generate cryptographically strong tokens and passwords.

What’s your view on addition of secrets to Python 3.6? Would you like to give the secrets module a try for generating tokens and passwords? Please share your views in the comment box below.

Source 1: http://www.blog.pythonlibrary.org/

Source 2: https://docs.python.org 


Last modified on
Hits: 11745
0
Product Engineering, software engineering company, Product Development, Product Migration, Product Re-engineering, Product Maintenance, Product Testing Commercial Application Development, Business Software development, commercial software for startups, Application Support and Maintenance, software testing Product Maintenance, Outsource product maintenance, product support and maintenance Product Migration, Product Re-engineering, product re-engineering services Product Research, Product Engineering, UI Prototyping Services Software Testing Services, Quality Assurance services, professional software testers, Load Testing, Functional Testing, Cross Platform, Browser Testing, Test Automation, Testing Tools, software quality analysis Functional Testing Services, software quality analysis, Software Testing Services, Application Testing Services, Functional Testing Types Automated Testing, Automated Testing Services, automation testing, test script development, Automation Test Tools, outsource automation testing Load Testing, Performance Testing Services, Load Testing Tools Offshore Software Development, Outsource software services, offshore outsourcing services, offshore software development services, IT outsourcing services, software quality assurance services, Offshore IT services, Custom Application Development Services, Offshore Product Engineering Benefits of IT Outsourcing, Offshore Software Development companies, offshore software development firms Outsource planning, IT outsourcing, IT development services, offshore IT companies, offshore software development Offshore Software Development, Outsource software services, offshore outsourcing services, offshore software development services, IT outsourcing services, software quality assurance services, Offshore IT services, Custom Application Development Services, Offshore Product Engineering Offshore Software Development, Outsource software services, offshore outsourcing services, offshore software development services, IT outsourcing services, software quality assurance services, Offshore IT services, Custom Application Development Services, Offshore Product Engineering