Password Security 🔑

<?php
// === NEVER do any of these ===

$password = "hunter2";

// ❌ 1. Plain text — a database leak hands the attacker every account.
$stored = $password;

// ❌ 2. md5 / sha1 — these are FAST hashes built for checksums, not secrets.
//    A modern GPU tries billions of guesses per second against them.
echo "md5:  " . md5($password) . "\n";   // always the same 32-char string
echo "sha1: " . sha1($password) . "\n";  // always the same 40-char string

// The killer problem: md5/sha1 are deterministic and unsalted, so the SAME
// password always gives the SAME hash. Attackers precompute giant lookup
// tables ("rainbow tables") and reverse millions of leaked hashes instantly.

// ❌ 3. "Encryption" — encryption is reversible by design. A password should
//    NEVER be recoverable. If you can decrypt it, so can whoever steals the key.
?>

md5:  f3bbbd66a63d4bf1747940578ec3d0103
sha1: f3bbbd66a63d4bf1747940578ec3d010 (illustrative — same input = same output)

<?php
// === The ONLY correct way: password_hash() + password_verify() ===

// --- Registration: hash once, store the hash ---
$password = "MyS3cur3P@ss!";
$hash = password_hash($password, PASSWORD_BCRYPT);  // slow + salted, on purpose

echo "Stored hash: " . $hash . "\n";
echo "Length:      " . strlen($hash) . " chars\n\n";  // 60 for bcrypt

// password_hash() bakes a RANDOM salt into every hash automatically, so the
// SAME password hashed twice produces TWO DIFFERENT strings — this is what
// makes rainbow tables useless.
$again = password_hash($password, PASSWORD_BCRYPT);
echo "Same password, two hashes equal? ";
var_export($hash === $again);   // false — different salts each time
echo "\n\n";

// --- Login: verify the typed password against the stored hash ---
// You do NOT re-hash and compare yourself. password_verify() re-extracts the
// salt from the stored hash, hashes the input the same way, and compares.
echo "Correct password: ";
var_export(password_verify("MyS3cur3P@ss!", $hash));  // true
echo "\nWrong password:   ";
var_export(password_verify("letmein", $hash));        // false
echo "\n";
?>

Stored hash: $2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
Length:      60 chars

Same password, two hashes equal? false

Correct password: true
Wrong password:   false

<?php
// === Choosing an algorithm + tuning the work factor ===

$password = "correct-horse-battery-staple";

// PASSWORD_BCRYPT: the "cost" is how many rounds of work. Each +1 DOUBLES the
// time. 10–12 is a sensible 2026 default — slow for an attacker, fine for you.
$bcrypt = password_hash($password, PASSWORD_BCRYPT, ["cost" => 12]);
echo "bcrypt prefix:  " . substr($bcrypt, 0, 7) . "\n";   // $2y$12$

// PASSWORD_ARGON2ID: the modern winner. It is MEMORY-hard, so it defeats the
// cheap GPU/ASIC farms that crack bcrypt. Tune memory, time, and threads.
$argon = password_hash($password, PASSWORD_ARGON2ID, [
    "memory_cost" => 65536,  // 64 MB of RAM per hash
    "time_cost"   => 4,      // 4 passes over that memory
    "threads"     => 2,      // parallel lanes
]);
echo "argon2 prefix:  " . substr($argon, 0, 9) . "\n\n"; // $argon2id

// === password_needs_rehash(): future-proofing on login ===
// Hardware gets faster, so you raise the cost over time. After a user logs in
// successfully you check whether their stored hash is below today's standard,
// and if so, silently upgrade it — the user never notices.
$oldHash = password_hash($password, PASSWORD_BCRYPT, ["cost" => 8]); // legacy

if (password_verify($password, $oldHash)) {
    if (password_needs_rehash($oldHash, PASSWORD_BCRYPT, ["cost" => 12])) {
        $newHash = password_hash($password, PASSWORD_BCRYPT, ["cost" => 12]);
        echo "Old hash was below standard -> rehashed to cost 12\n";
        // saveHashToDatabase($userId, $newHash);  // persist the upgrade
    }
}
?>

bcrypt prefix:  $2y$12$
argon2 prefix:  $argon2id

Old hash was below standard -> rehashed to cost 12

<?php
// 🎯 YOUR TURN — wire up registration and login. Fill each ___ , then run it.

$password = "Tr0ub4dor&3";

// 1) Hash the password for storage (use the Argon2id algorithm constant)
$hash = password_hash($password, ___);   // 👉 use PASSWORD_ARGON2ID

// 2) Simulate the right password at login
$loginOk = password_verify("Tr0ub4dor&3", $hash);

// 3) Simulate a WRONG password at login
$loginBad = password_verify(___, $hash);  // 👉 pass any wrong string, e.g. "nope"

echo "Right password verifies? ";  var_export($loginOk);   echo "\n";
echo "Wrong password verifies? ";  var_export($loginBad);  echo "\n";

// ✅ Expected output:
//    Right password verifies? true
//    Wrong password verifies? false
?>

Right password verifies? true
Wrong password verifies? false

<?php
// 🎯 YOUR TURN — upgrade a weak old hash on login. Fill each ___ , then run it.

$password = "summer-2019-account";
$oldHash  = password_hash($password, PASSWORD_BCRYPT, ["cost" => 8]); // legacy

// Only ever rehash AFTER a successful verify — never rehash a wrong password.
if (password_verify($password, $oldHash)) {

    // 1) Ask whether the stored hash is below today's standard (cost 12)
    $needs = password_needs_rehash($oldHash, PASSWORD_BCRYPT, [___]);  // 👉 "cost" => 12

    if ($needs) {
        // 2) Create the stronger hash to save back to the database
        $newHash = password_hash($password, PASSWORD_BCRYPT, ["cost" => 12]);
        echo "Upgraded? ";  var_export($newHash !== $oldHash);  echo "\n";
    }
}

// ✅ Expected output:
//    Upgraded? true
?>

Upgraded? true

<?php
// === Three defences AROUND the hash ===

// 1) hash_equals(): constant-time comparison for tokens you compare yourself.
//    A normal === on secrets (password-reset tokens, API keys, HMAC signatures)
//    can leak info: it returns the moment two bytes differ, so an attacker can
//    measure timing to guess a token byte by byte. hash_equals() always takes
//    the same time regardless of where the mismatch is.
$expected = "a1b2c3d4e5f6";          // the real reset token from your database
$provided = $_GET["token"] ?? "";    // whatever the user sent

if (hash_equals($expected, $provided)) {   // ✅ timing-safe
    echo "Token valid\n";
} else {
    echo "Token invalid\n";
}
// (For passwords you never need this — password_verify() is already constant-time.)

// 2) Rate limiting: cap how many guesses an attacker gets per account.
$maxAttempts = 5;
$attempts = 6;  // pretend we counted this many recent failures for this user
if ($attempts >= $maxAttempts) {
    echo "Too many attempts — try again in 15 minutes\n";  // block, don't verify
}

// 3) Reject known-breached passwords (Have I Been Pwned, k-anonymity).
//    You send only the FIRST 5 chars of the SHA-1, never the password itself,
//    then check the returned list locally.
$sha1   = strtoupper(sha1("password123"));   // hash the candidate
$prefix = substr($sha1, 0, 5);               // send only these 5 chars
$suffix = substr($sha1, 5);                  // match this locally
echo "Would query: api.pwnedpasswords.com/range/$prefix\n";
echo "Then check the response for suffix $suffix\n";
?>

Token invalid
Too many attempts — try again in 15 minutes
Would query: api.pwnedpasswords.com/range/CBFDA
Then check the response for suffix C4C4E72... (if present, the password is breached)