Proposal: Password Hashing about miniserve

[svenstaro]

To clarify, it would look like this: --auth hi:sha256:hash Think about it.

…

On Thu, Apr 18, 2019, 11:32 Sven-Hendrik Haase ***@***.***> wrote: Alternatively, the normal auth option could be extended to accept a hash prefix such as sha256 and then we don't have to add a parameter per password hash type. On Thu, Apr 18, 2019, 08:24 Khải ***@***.***> wrote: > Problem > > miniserve already has an --auth feature, however, the password is > publicly visible > Solution > > Add a flag called --auth-sha256 that accepts username:password_hash. > ------------------------------ > > P.S. I am trying to learn Rust by contributing to this repository, so > don't implement this feature just yet. > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > <#75>, or mute the thread > <https://github.com/notifications/unsubscribe-auth/AAAANAG2BHB4GFGU4RB2UOTPRAHYFANCNFSM4HG2CHLA> > . >

[svenstaro]

Alternatively, the normal auth option could be extended to accept a hash prefix such as sha256 and then we don't have to add a parameter per password hash type.

…

On Thu, Apr 18, 2019, 08:24 Khải ***@***.***> wrote: Problem miniserve already has an --auth feature, however, the password is publicly visible Solution Add a flag called --auth-sha256 that accepts username:password_hash. ------------------------------ P.S. I am trying to learn Rust by contributing to this repository, so don't implement this feature just yet. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#75>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAANAG2BHB4GFGU4RB2UOTPRAHYFANCNFSM4HG2CHLA> .

[KSXGitHub]

--auth hi:sha256:hash

It looks cool.

[KSXGitHub]

@svenstaro I find using : as separator to be pretty limited. What if we want to support other things (e.g. salt) in the future?

How about this?

--auth username%sha256#hash&salt

The idea is: Instead of using : as separator, I want to use :, %, #, & as leading indicators.

[svenstaro]

I don't want to overcomplicate this too much. After all, this tool's primary selling point is ease of use. I don't think we need a salt.

…

On Thu, Apr 18, 2019, 12:43 Khải ***@***.***> wrote: @svenstaro <https://github.com/svenstaro> I find using : as separator to be pretty limited. What if we want to support other things (e.g. salt) in the future? How about this? --auth username%sha256#hash&salt The idea is: Instead of using : as separator, I want to use :, %, #, & as leading indicators. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#75 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAANAFAWCL4R3ZLMEA443LPRBGEJANCNFSM4HG2CHLA> .

[svenstaro]

That said I'd be ok with using another separator.

[KSXGitHub]

Well, I already edit parse_base_auth and I don't want to change it again because I'm lazy.