pub const DUMMY_HASH: &str = "$2b$10$Wd1gvrMYPnQv5pHBbXCwCehxXmJSEzRqNON0ev98L6JJP5296S35i";Expand description
Upstream’s fixed dummy hash, for timing normalization (password.js:33).
The value is irrelevant and the cost is the point. A login that fails before reaching bcrypt
returns in microseconds while one that reaches it pays the full cost factor, and that difference
is measurable over the network. It answers “does this account exist” without any response body
saying so, which is exactly what the single shared Invalid username/password. message exists
to prevent. The message alone does not close the oracle; this does.
Cost factor 10, matching upstream’s, because a dummy compare cheaper than the real one leaks the difference just as well.