From 9f99bbdb765fc70373943930d543ce1cde7a5f35 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 7 Aug 2026 22:59:05 -0700 Subject: auth: hash passwords at bcrypt cost 12 with transparent upgrade (S2) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Registration, password change, and admin reset all hashed at bcrypt cost 4 (16 rounds, ~1,300 guesses/s/thread) — the single factor gating the custodial balance and the nip49 passphrase for the stored nostr key. Raise all three sites to cost 12, and on successful login re-hash any legacy cost-4 hash now that we hold the verified plaintext. Co-Authored-By: Claude Opus 4.8 --- lib/register.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/register.ts b/lib/register.ts index bd1049c8..16aa5b02 100644 --- a/lib/register.ts +++ b/lib/register.ts @@ -32,7 +32,7 @@ export default async (user, ip) => { if (password) { user.password = await Bun.password.hash(password, { algorithm: "bcrypt", - cost: 4, + cost: 12, }); } -- cgit v1.2.3