Search code examples
pythonsha1django-registration

django-registration and sha1 as hash algorithm

I have been using django-registration for my django applications(thanks to James Bennett).I read some articles which spoke about the importance of using safe hash algorithms and using a salt for password hashing.. When I took a look at the source code of django-registration,I found that sha1 is used for creating activation_key

activation_key = hashlib.sha1(salt+username).hexdigest()

sha1 to my knowledge, is no longer a safe hash algorithm. I was wondering if there was some way I could set the hash algorithm to be used .

what do you guys recommend?

Solution

  • I recommend you re-examine what it's being used for here. When used to store an unsalted password, SHA-1 is weak. When used with a salt to generate a not-quite-random identifier, it is fairly safe.