# Authentication and Password Setup

GGSight is local-first. The desktop scanner does not require an account for first use and must not collect or store account passwords locally.

## Current MVP Boundary

- Local scanning, OCR, encounter history, exports, and notifications work without login.
- The desktop app may store a backend device token for optional public lookup access.
- Device tokens are treated as secrets and are redacted from settings views.
- Password-based accounts are reserved for later cloud features such as sync, backup, paid plans, subscription management, and multi-device history.

## Password Rules

When account login is enabled, password handling must stay backend-only:

- Normalize email addresses before account lookup.
- Require passwords of at least 12 characters.
- Reject common passwords and passwords that include the email username.
- Allow passphrases rather than forcing brittle composition rules.
- Store only salted PBKDF2-SHA256 password hashes.
- Verify passwords with constant-time comparison.
- Rehash passwords when the configured iteration count increases.
- Never log, export, sync, or store plaintext passwords in desktop settings.

## Token Rules

- Session and device tokens must be generated with cryptographically secure randomness.
- Durable storage should keep token digests, not raw tokens.
- Bearer tokens should be sent over HTTPS only.
- Device-token checks should use constant-time comparison.
- Production verification endpoints must set `GGSIGHT_BACKEND_DEVICE_TOKENS` to a comma-separated list of allowed raw tokens or `sha256$...` token digests.

## Account Features Before Launch

Before public account login ships, implement:

- Email verification.
- Password reset with single-use, expiring, hashed reset tokens.
- Login rate limits by account, IP, and device.
- Session revocation and logout-all-devices.
- Account deletion and data export flows.
- Audit logging for account security events without sensitive values.
- Support process for compromised account reports.
