yesnault/Play20StartApp — pull request #1 by wsargent (2012-05-17 02:56:50+00:00)
Title: bcrypt and token changes

Hi there,

I took your starter app and changed it so it uses bcrypt as the internal encryption algorithm and does not send password or new passwords over the wire. I've been reading about security and encryption, and put together everything on this web page:

http://webapp-hardening.heroku.com/insecure_crypto

coming from a talk I did here:

http://tersesystems.com/2012/02/17/failing-with-passwords

It's been a real eyeopener how security has changed -- password crackers and network sniffers have advanced to the point where attackers can crack things in days, if not hours.

Hope this helps, please talk to me if you want to know more. I do speak French, but it's been a few years.

Will.