Replace Bcrypt with Argon2 for better security.

Bcrypt is now somewhat vulnerable to offline cracking, so we move our password
hashing over to Argon2.

1 files changed, 2 insertions, 2 deletions

diff --git a/main.py b/main.py
index 6dadac2..49e5d55 100644
--- a/main.py
+++ b/main.py
@@ -7,7 +7,7 @@ from datetime import datetime
 
 
 import click
-import bcrypt
+from argon2 import PasswordHasher
 from yoyo import get_backend, read_migrations
 
 from gn3 import migrations
@@ -37,7 +37,7 @@ def __init_dev_users__():
         "password": "testpasswd"},)
 
     def __hash_passwd__(passwd):
-        return bcrypt.hashpw(passwd.encode("utf8"), bcrypt.gensalt())
+        return PasswordHasher().hash(passwd)
 
     with db.connection(app.config["AUTH_DB"]) as conn, db.cursor(conn) as cursor:
         cursor.executemany(dev_users_query, dev_users)