Question 1

Why should I never store passwords in plain text?

Accepted Answer

If passwords are stored as written, anyone who obtains the database obtains every account immediately. That includes an attacker exploiting an unrelated vulnerability, a backup left accessible, or an employee with database access. The damage also extends well beyond your service, because people reuse passwords, so your breach compromises their email and banking too.

The correct approach is to store a hash: a one-way transformation you can verify against without being able to reverse. At login you hash the supplied password and compare, so the original is never stored.

The details matter more than the principle, and getting them wrong is common.

General-purpose hash functions such as SHA-256 are the wrong tool despite being cryptographically sound. They are designed to be fast, and speed is exactly what an attacker wants: modern hardware computes billions per second, so a stolen database of fast hashes falls quickly to brute force.

What you want is a deliberately slow algorithm designed for passwords, with a tunable work factor so it can be made more expensive as hardware improves. Argon2 is the current recommendation, with bcrypt and scrypt remaining acceptable and widely available.

Salting is essential and handled automatically by these algorithms. A unique random salt per password means identical passwords produce different hashes, which defeats precomputed lookup tables and prevents an attacker learning that two users share a password.

The strongest practical advice is not to implement any of this yourself. Use your framework's password hashing facility, or delegate authentication entirely to an identity provider. This is a well-solved problem where custom implementations reliably introduce subtle flaws.

Question 2

What techniques can I use to tune the performance of MongoDB?

Accepted Answer

MongoDB performance tuning techniques include indexing, sharding, schema design, connection pooling, query optimization, and hardware optimization. Each method enhances database efficiency and responsiveness.

Question 3

How should application secrets actually be managed?

Accepted Answer

Kept out of source code entirely, injected at runtime, scoped narrowly, and rotatable without a deployment — and the reason this matters is that a secret committed to a repository is permanently

Question 4

What is a hash table, and why is lookup constant time?

Accepted Answer

A structure that turns a key into an array index by computing a number from it, so finding an item takes roughly the same time whether the table holds ten entries or ten million. The mechanism. A

Question 5

How do I remove a file containing secrets from Git history?

Accepted Answer

Start with the part people skip: if a credential was pushed anywhere others could read it, treat it as compromised and rotate it first. Rewriting history removes the file from the repository, but it

Question 6

How to implement authentication in Django?

Accepted Answer

Implementing authentication in Django involves using built-in views, custom views, third-party packages, or token-based methods. Each method serves different needs based on application requirements.

Question 7

What are sharding and partitioning?

Accepted Answer

Both split a large dataset into pieces. Partitioning divides a table within one database; sharding distributes data across separate database instances. The distinction matters because one is an

Related Questions