Area riservata
Create an account
You do not need one to read the course — everything already works in this browser. An account keeps a second copy on the server, so your progress survives a cleared profile and follows you to another machine.
What happens to what you type
- The password is stored as a PBKDF2-HMAC-SHA256 hash, 210 000 iterations, with its own random salt. The stored string names its own parameters, so the cost can be raised later and old rows upgrade themselves on the next successful sign-in.
- There is no email verification and no password reset, because both need a mail server this project does not have. A forgotten password means a new account. That is a missing feature, written down rather than hidden.
- Registering an address that already exists does not answer “already registered” — that answer would turn this form into a way of asking who has an account. It quietly tries to sign you in instead.
- You can delete the account and everything in it from the reserved area, in one click. A tool that stores your history and offers no way out is one you should not sign in to.
The reasoning in full is in docs/ACCOUNTS.md and in chapter 15
of the fieldbook.