auth-hardening
Installation
SKILL.md
Auth Hardening
Harden authentication to prevent unauthorized access. Weak auth is OWASP A07 and a direct path to PDPA liability -- if attackers access user data through weak login security, the developer is negligent.
The Rule
NEVER roll your own crypto. ALWAYS use proven libraries with secure defaults.
Password Hashing
The Only Acceptable Algorithms
| Algorithm | When to use | Config |
|---|---|---|
| Argon2id | New projects (recommended) | memory: 64MB, iterations: 3, parallelism: 4 |
| bcrypt | Existing projects, wide support | cost factor: 12+ |
| scrypt | Alternative to Argon2 | N=2^17, r=8, p=1 |
NEVER use: MD5, SHA-1, SHA-256 (without salt+stretch), plain text