I am recently working on a program using Pyqt5, and building my self a small software.
the software requires username and password to login , and I want to set once the user name and password, save it in a safe way, and to prevent someone who has my code\ access to my computer to be able to login to my software.
what I did so far is to use keyring module to set a password, and to hash it with passlib - which eventully saves my password after doing hash to it. when the user trys to login - the code takes the entered password and compare it to the hash password in keyring files.
So to the questions are:
- is it a good way to save the user password like this? is it safe?
- how can i prevent someone with access to my code or my computer to just open the code and look on the password?
here is the password hash script:
from passlib.context import CryptContext
import keyring
# create CryptContext Object
context = CryptContext(
schemes=["pbkdf2_sha256"],
default="pbkdf2_sha256",
pbkdf2_sha256__default_rounds=50000
)
def password_encrypter (password):
# hash password
hashed_password = context.hash(password)
return hashed_password
def password_hiding (password):
# Gets password from user and encrypt it
hashed_password = password_encrypter(password)
# Hides The Password
keyring.set_password("service_name", "user_name", hashed_password)
check_if_hashed = context.verify(password, hashed_password)
password1 = keyring.get_password("service_name", "user_name")
# Just for testing
print ("password from user" , password)
print ("hashed password : " ,hashed_password)
print("password from keyring: " , password1)
return password1
def password_validatation (password):
hidden_password = password_hiding(password)
check_if_hashed = context.verify(password, hidden_password)
print(check_if_hashed)
return check_if_hashed
# Test
password_validatation("my_password")
I am adding also the login script:
from PyQt5 import QtWidgets
# from mainwindow import Ui_MainWindow
from qtwidgets import PasswordEdit
from .password_generator import password_validatation
class Login(QtWidgets.QDialog):
def __init__(self, parent=None):
super(Login, self).__init__(parent)
self.textName = QtWidgets.QLineEdit(self)
self.textPass = PasswordEdit()
self.buttonLogin = QtWidgets.QPushButton('Login', self)
self.buttonLogin.clicked.connect(self.handleLogin)
layout = QtWidgets.QVBoxLayout(self)
layout.addWidget(self.textName)
layout.addWidget(self.textPass)
layout.addWidget(self.buttonLogin)
def handleLogin(self):
password = password_validatation(self.textPass.text())
if (self.textName.text() == 'user_name' and
self.textPass.text() == True):
self.accept()
else:
QtWidgets.QMessageBox.warning(
self, 'Error', 'Bad user or password!')
class Window(QtWidgets.QMainWindow):
def __init__(self, parent=None):
super(Window, self).__init__(parent)
# self.ui = Ui_MainWindow()
# self.ui.setupUi(self)
def main():
import sys
app = QtWidgets.QApplication(sys.argv)
login = Login()
if login.exec_() == QtWidgets.QDialog.Accepted:
window = Window()
window.show()
sys.exit(app.exec_())
if __name__ == '__main__':
main()