title: werkzeug generate_password_hash, is there any point?
body: <p>I'm building a python app that uses <a href="http://werkzeug.pocoo.org/docs/0.12/utils/#module-werkzeug.security" rel="nofollow noreferrer">werkzeug's hashing functions</a>. An example <code>User</code> model:</p>
  
  <pre class="lang-py prettyprint-override"><code>class User(db.Model):
      __tablename__ = 'users'
      id = db.Column(db.Integer, primary_key=True)
      username = db.Column(db.String(64), unique=True, index=True)
      role_id = db.Column(db.Integer, db.ForeignKey('roles.id'))
      password_hash = db.Column(db.String(128))
  
      # Custom property getter
      @property
      def password(self):
          raise AttributeError('password is not a readable attribute')
  
      # Custom property setter
      @password.setter
      def password(self, password):
          self.password_hash = generate_password_hash(password)
  
      def verify_password(self, password):
          return check_password_hash(self.password_hash, password)
  
      def __repr__(self):
          return '&lt;User %r&gt;' % self.username
  </code></pre>
  
  <p>I see that now the <code>password</code> is stored as a hash in the database and any attacker who sees the hash won't know what the password is without decrypting it. However isn't werkzeug's hashing function a fairly obvious choice for a lot of apps? Could the attacker just use the <a href="http://werkzeug.pocoo.org/docs/0.12/utils/#werkzeug.security.check_password_hash" rel="nofollow noreferrer"><code>check_password_hash</code></a> function and decrypt the password?</p>