Simon Willison’s Weblog

Don’t Hash Secrets. A well written explanation from 2008 of why you must use hmac instead of raw SHA-1 when hashing against a secret.

# 24th January 2010, 1:30 pm / hmac, signing, sha1, cryptography, security

Design and code review requested for Django string signing / signed cookies. Do you know your way around web app security and cryptography (in particular signing things using hmac and sha1)? We’d appreciate your help reviewing the usage of these concepts in Django’s proposed string signing and signed cookie implementations.

# 4th January 2010, 1:24 pm / django, python, security, hashing, sha1, hmac, cryptography, codereview