Set your Publisher ID in src/config/ads.ts to display live ads.
Authentication, Hashing & Password Security
Why plain text storage is criminal: bcrypt, argon2, salting, and MFA
Storing passwords in plain text or using outdated algorithms like MD5 or SHA1 leads directly to catastrophic data breaches. Modern security mandates slow, salted adaptive hashing functions.
The Mechanics of Modern Password Hashing
NEVER use fast cryptographic hashes like SHA-256 for passwords: GPUs can compute billions of SHA-256 hashes per second, making brute-force and rainbow table attacks trivial.
Salt: A cryptographically random string appended to the password before hashing, guaranteeing that two users with identical passwords have completely different hashes, thwarting precomputed rainbow tables.
Adaptive Work Factors (bcrypt / Argon2id): Intentionally slow down computation (e.g. requiring 100ms per attempt) to make offline brute-force attacks economically and physically impossible for attackers.
import bcrypt from 'bcrypt';
const SALT_ROUNDS = 12; // Work factor: 2^12 iterations
// Hashing during user registration
async function registerUser(plainTextPassword) {
const hash = await bcrypt.hash(plainTextPassword, SALT_ROUNDS);
// Store only the resulting hash in the database, NEVER the plain text!
return hash;
}
// Verifying during login
async function verifyLogin(enteredPassword, storedHash) {
const match = await bcrypt.compare(enteredPassword, storedHash);
return match; // true if valid, false otherwise
}Set your Publisher ID in src/config/ads.ts to display live ads.
Test Yourself With Exercise
Why are fast cryptographic algorithms like SHA-256 or MD5 dangerous for storing user passwords?