MEDIUM: Argon2 password hash parameters below OWASP recommendations

[Inkcha]

Description

apps/web/lib/password.ts configures Argon2id with memoryCost=19456 (~19MB), timeCost=2, parallelism=1. OWASP recommends memoryCost >= 47104 (46MB) and timeCost >= 3 for production password hashing.

Location

apps/web/lib/password.ts:L4-L8:

const opts = {
  memoryCost: 19456,
  timeCost: 2,
  parallelism: 1,
};

Impact

Weaker-than-recommended password hash resistance. Each hash requires less computation than OWASP guidelines suggest, making offline brute-force attacks cheaper if the database is compromised.

Suggested Fix

Update to OWASP-recommended minimums:

const opts = {
  memoryCost: 47104,  // 46 MiB
  timeCost: 3,
  parallelism: 1,
};