Introducing the secrets module

[Irmen de Jong]

On 17-4-2016 4:36, Steven D'Aprano wrote:

> And the documentation:
> 
> https://docs.python.org/3.6/library/secrets.html
> 
> 
> Comments requested.

I've read about the "How many bytes should tokens use?" consideration. It suggests that
to be secure, tokens need to have sufficient randomness. The default token length is
subject to change at any time to remain secure against brute-force.
However the API allows you to supply any token length, even one that is (a lot) shorter
than the default.
In view of the rationale for this new module ("Python's standard library makes it too
easy for developers to inadvertently make serious security errors") should it perhaps
not be allowed to use a value that is less than the default?

Hm, perhaps it should not; enforcing this could break code suddenly in the future when
the default is raised...

Irmen