yesodweb/yesod — pull request #707 by paul-rouse (2014-04-08 17:11:05+00:00)
Title: Reinstate HashDB, with compatible security enhancement

I would like to propose reinstating HashDB, but with this security enhancement to fix https://github.com/yesodweb/yesod/issues/668. It now uses Crypto.PasswordStore, but falls back to the old hash algorithm for verification if it finds database entries of the old format. It also provides an upgrade path which can be used on the database entries alone to strengthen them, avoiding the main security problem of the old algorithm (that a single round of SHA is too fast).

I am aware of yesod-auth-bcrypt, but it is not compatible with existing databases, and at the moment does not compile with the latest Yesod Platform. I have put my efforts into this one because it is vitally important to me to have compatibility, plus a suitable upgrade path for existing databases.

You will see I've added my name as the maintainer - I am happy to do that, since I have to have this module for a real application!