- [Instructor] It's a very bad practice
to store password in plaintext
because if your data gets compromised,
the intruder will gain access to all passwords as well.
As users tend to reuse passwords in different places,
this would cause a huge security threat.
This is why we will now add a function
that will automatically hash any password
before it gets stored into the database.
We will use bcrypt for that.
It's a hashing function dedicated for passwords.
bcrypt takes two input argument,
the password and the number of hashing rounds
we want to perform.
The more rounds you use,
the harder it is to use brute force
to get back to the original password.
bcrypt gives us a hash that consists of
a version information,
the number of rounds that have been used,
the salt that has been used, and the actual hash.
Now we have a hash that we can store in the database,
but how do we find out if a given password is correct?
Luckily, bcrypt is deterministic.
This means that, given the same input arguments,
it will always end up with the same hash.
It also provides a compare function
with linear execution time to prevent timing attacks.
These are attacks that use
the execution time after comparison
to guess how close a given password is to the real one.
If you want to learn more about how bcrypt works,
please use the link shown below.