psybuzz/goldenconversations — pull request #34 by psybuzz (2014-12-20 20:47:12+00:00)
Title: Store/compare with encrypted passwords

This PR makes new changes to the way that passwords are stored on user creation as well as how passwords are compared when logging in. Such changes use the Bcrypt node module to bring an added level of security that should likely be expected of any publicly facing webapp.

After password encryption, we will no longer be storing plaintext passwords in our database, which means that we will not be able to view any user's real password. From an ethical perspective, this implies that, given an official request to reveal our users' passwords, we will be technically unable to do so.

From a technical perspective, any accounts that were created prior to this PR will be unable to login. As such, we can either:
- Wipe the Mongo database and start fresh with new accounts
- Write a script to hash all existing passwords