Verify function always return true, am I doing wrong? about password4j HOT 5 CLOSED

Hi @RasyiidWho,

what happens if you do something like this?

Hash hash = Password.hash("uwu").withBCrypt();
boolean verified = Password.check("wrong password", hash.getResult()).withBCrypt();

if(verified)
{
    // Print "OK"
} 
else
{
    // Print "KO"
}

What are the configurations in your psw4j.properties file?
Do you have the same issue on a classic Java application or just on Android?
Thanks

from password4j.

what happens if you do something like this?

I have tried using this code

Hash hash = Password.hash("uwu").withBCrypt();
boolean verified = Password.check("wrong password", hash.getResult()).withBCrypt();

if(verified)
{
    // Print "OK"
} 
else
{
    // Print "KO"
}

but still gives me same result (always return true)

What are the configurations in your psw4j.properties file?

I'm on Android Studio IDE with gradle as a build tool. I've try to put psw4j.properties in classpath, but it's seems library not picking up the properties file. Trying to use gradle.properties and set jvm argument org.gradle.jvmargs=-Dpsw4j.configuration=G\:\\AndroidStudioProject\\ROUTEKNIS\\psw4j.properties but still the same (not picking up the properties file). So for now it uses default properties

Do you have the same issue on a classic Java application or just on Android?

I tried your code in NetBeans IDE, and it's working well, so it only happen on Android, even not all Android phone have this issue

from password4j.

On which Android devices is working? Do they have something in common?

from password4j.

On which Android devices is working? Do they have something in common?

I have test in on 3 phones. There are 2 physical device (android 10 & 6) and 1 emulator device (android 10). And this problem only happend in 1 physical device that have android 10.

from password4j.

I've tried the following in a build.gradle file

plugins {
    id 'java'
    id 'application'
}

applicationDefaultJvmArgs = ["-Dpsw4j.configuration=/path/to/file.properties"]

And the file is correctly read on Unix systems.

On Windows I suggest to to not escape :
You can use
G:\\AndroidStudioProject\\ROUTEKNIS\\psw4j.properties
or
G:/AndroidStudioProject/ROUTEKNIS/psw4j.properties

You should also check on your device if there's some known problem with the generation of random bytes.
You can check with the following property if the problem occurs again:

global.random.strong=true

This is always recommended if your JVM supports SecureRandom.getInstanceStrong() and it points to a non-blocking source of entropy, otherwise you may experience huge performance drops.

Also check if this method returns every time different results:

SaltGenerator.generate();

from password4j.