FixTheVuln

# Entropy calculation
# Entropy = log2(character_set_size ^ password_length)

# 8 characters, 95 printable ASCII
entropy = log2(95^8) = ~52.6 bits

# 16 characters, 95 printable ASCII
entropy = log2(95^16) = ~105.2 bits

# Each additional character DOUBLES the keyspace
# Adding complexity requirements barely helps
# and makes passwords harder to remember

// Register a new passkey (JavaScript)
async function registerPasskey() {
  const publicKeyCredentialCreationOptions = {
    challenge: new Uint8Array(32), // from server
    rp: {
      name: "My Application",
      id: "example.com"
    },
    user: {
      id: new Uint8Array(16), // user ID from server
      name: "[email protected]",
      displayName: "User Name"
    },
    pubKeyCredParams: [
      { alg: -7, type: "public-key" },   // ES256
      { alg: -257, type: "public-key" }  // RS256
    ],
    authenticatorSelection: {
      authenticatorAttachment: "platform",
      userVerification: "required",
      residentKey: "required"
    },
    timeout: 60000,
    attestation: "none"
  };

  const credential = await navigator.credentials.create({
    publicKey: publicKeyCredentialCreationOptions
  });

  // Send credential to server for storage
}

# Python - Using Argon2
from argon2 import PasswordHasher

ph = PasswordHasher(
    time_cost=3,
    memory_cost=65536,
    parallelism=4,
    hash_len=32,
    salt_len=16
)

# Hash password
hash = ph.hash("user_password")

# Verify password
try:
    ph.verify(hash, "user_password")
    if ph.check_needs_rehash(hash):
        # Update hash with new parameters
        new_hash = ph.hash("user_password")
except VerifyMismatchError:
    print("Invalid password")

# Node.js - Using bcrypt
const bcrypt = require('bcrypt');

const saltRounds = 12;

// Hash password
const hash = await bcrypt.hash(password, saltRounds);

// Verify password
const match = await bcrypt.compare(password, hash);

# PHP - Using password_hash (bcrypt by default)
// Hash
$hash = password_hash($password, PASSWORD_ARGON2ID, [
    'memory_cost' => 65536,
    'time_cost' => 4,
    'threads' => 3
]);

// Verify
if (password_verify($password, $hash)) {
    if (password_needs_rehash($hash, PASSWORD_ARGON2ID)) {
        // Rehash with updated parameters
    }
}

# Check password against HaveIBeenPwned (k-anonymity)
import hashlib
import requests

def check_pwned(password):
    sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
    prefix, suffix = sha1[:5], sha1[5:]

    response = requests.get(
        f'https://api.pwnedpasswords.com/range/{prefix}',
        headers={'Add-Padding': 'true'}
    )

    for line in response.text.splitlines():
        hash_suffix, count = line.split(':')
        if hash_suffix == suffix:
            return int(count)  # Found in breaches
    return 0  # Not found

# Usage
breach_count = check_pwned("password123")
if breach_count > 0:
    print(f"Password found in {breach_count} breaches!")