weak-password-hashing-anti-pattern

Detect weak password hashing by analyzing code for outdated algorithms like MD5, SHA1, or unsalted SHA256. This identifies CWE-327 and CWE-759 vulnerabilities, preventing mass account compromise through easily crackable stored credentials.

Unsalted SHA256 is a password storage anti-pattern because identical passwords produce identical hashes, making them vulnerable to rainbow table attacks. Secure password storage requires algorithms like bcrypt or Argon2 with unique salts to prevent rapid cracking.

Securely hash passwords using robust algorithms like bcrypt, Argon2, or scrypt with proper salting. This approach ensures secure password storage and verification, protecting user authentication data from rapid cracking by attackers.

Argon2 and bcrypt both provide secure password hashing by incorporating salting and computational cost. Argon2 offers modern memory-hard resistance against specialized cracking hardware, while bcrypt remains a proven standard for secure password storage.

Review password storage implementations for CWE-327 vulnerabilities whenever auditing user authentication code. Checking for insecure hashing algorithms and missing salts ensures credentials are not stored in a way that makes them easily crackable by attackers.