Do not default to py-bcrypt because it is hard to install and configu…

…re. Default to SHA512 and strongly suggest bcrypt instead. Closes issue #41.

settings.py

@@ -55,9 +55,9 @@
 
 ## Accepted locales
 
-# On dev instances, the list of accepted locales defaults to the contents of 
-# the `locale` directory.  A localizer can add their locale in the l10n 
-# repository (copy of which is checked out into `locale`) in order to start 
+# On dev instances, the list of accepted locales defaults to the contents of
+# the `locale` directory.  A localizer can add their locale in the l10n
+# repository (copy of which is checked out into `locale`) in order to start
 # testing the localization on the dev server.
 try:
     DEV_LANGUAGES = [
@@ -67,7 +67,7 @@
 except OSError:
     DEV_LANGUAGES = ('en-US',)
 
-# On stage/prod, the list of accepted locales is manually maintained.  Only 
+# On stage/prod, the list of accepted locales is manually maintained.  Only
 # locales whose localizers have signed off on their work should be listed here.
 PROD_LANGUAGES = (
     'en-US',
@@ -250,8 +250,8 @@ def JINJA_CONFIG():
 JAVA_BIN = '/usr/bin/java'
 
 ## Auth
-PWD_ALGORITHM = 'bcrypt'
-HMAC_KEYS = {
+PWD_ALGORITHM = 'sha512'  # recommended: 'bcrypt'
+HMAC_KEYS = {  # for bcrypt only
     #'2011-01-01': 'cheesecake',
 }
 

settings_local.py-dist

@@ -20,6 +20,9 @@ DATABASES = {
         'TEST_CHARSET': 'utf8',
         'TEST_COLLATION': 'utf8_general_ci',
     },
+    # 'slave': {
+    #     ...
+    # },
 }
 
 # Recipients of traceback emails and other notifications.
@@ -35,3 +38,12 @@ DEBUG = TEMPLATE_DEBUG = True
 # Is this a development instance? Set this to True on development/master
 # instances and False on stage/prod.
 DEV = True
+
+# Playdoh ships with sha512 password hashing by default. Bcrypt+HMAC is safer,
+# so it is recommended. Please read <https://github.com/fwenzel/django-sha2#readme>,
+# then switch this to bcrypt and pick a secret HMAC key for your application.
+#PWD_ALGORITHM = 'bcrypt'
+#HMAC_KEYS = {  # for bcrypt only
+#    '2011-01-01': 'cheesecake',
+#}
+