# Voicing my concerns with passlib (security) and its larger adoption by Ansible

**URL:** <https://forum.ansible.com/t/voicing-my-concerns-with-passlib-security-and-its-larger-adoption-by-ansible/38527>\
**Category:** Ansible Project\
**Created:** [October 17, 2023, 4:46pm UTC](https://forum.ansible.com/t/voicing-my-concerns-with-passlib-security-and-its-larger-adoption-by-ansible/38527 "2023-10-17T16:46:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thibaut\_Barrere](https://avatars.discourse-cdn.com/v4/letter/t/ea666f/32.png) [@Thibaut\_Barrere](https://forum.ansible.com/u/Thibaut_Barrere)\
**Post date:** [October 17, 2023, 4:46pm UTC](https://forum.ansible.com/t/voicing-my-concerns-with-passlib-security-and-its-larger-adoption-by-ansible/38527/1 "2023-10-17T16:46:25Z")

</div>

Hello,

While doing Ansible maintenance work, I discovered that the passlib library used by Ansible (currently only for Mac users) has not seen any release in 3 years.

I am a bit concerned about how interesting it would be as an attack target (especially since it encrypts passwords), e.g. Pypi account take-over.

I have opened various issues:

- [https://foss.heptapod.net/python-libs/passlib/-/issues/187](https://foss.heptapod.net/python-libs/passlib/-/issues/187) to try to get an update on the passlib maintenance status
- [https://github.com/ansible/ansible/issues/81949](https://github.com/ansible/ansible/issues/81949) to raise awareness about that

While doing so, I have learned that passlib is actually likely to be used for all Ansible users soon, not just Mac ones, which makes an account take-over an even more interesting goal.

The issue has been closed, but I feel this should be taken care of (I have suggested ideas), so I’m voicing my concerns here.

An account take-over of passlib (I don’t know if it has 2FA enabled, for instance) would have potentially massive impact on Ansible users.

If anyone has interesting ideas, let me know!

Thibaut