Interview prompt
Explain store password verifiers, not recoverable passwords to an engineer who understands the surrounding system but has not used this technique. Walk from its contract to a concrete operation, then discuss where it fails or becomes expensive.
A strong answer
Password storage should make a stolen database expensive to search. A password hashing function is intentionally slow and memory-intensive compared with a general-purpose hash. Each password needs a unique random salt so equal passwords do not produce equal stored verifiers.
At registration, the service generates a salt and computes a verifier using a password-hashing algorithm with a configured cost. At login, it recomputes the verifier and compares safely. The stored record includes the algorithm parameters so the service can increase cost and rehash after successful authentication.
A complete answer also calls out the assumptions that control correctness. Encryption is reversible with a key and is not a substitute for password hashing. A fast hash such as plain SHA-256 permits attackers to test guesses too quickly. No password scheme protects weak user choices completely, so rate limits and multifactor options still matter.
Close by describing one representative test or measurement. A database export reveals salts and password verifiers. Explain what salts prevent, what they do not prevent, and why the chosen hash must be expensive to compute.
Follow-up questions
Answer the follow-ups in the frontmatter. Use the linked article for the concept and the trace to make the explanation concrete.