# Nodered hacked by adding invisible nodes

**URL:** <https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860>\
**Category:** General\
**Tags:** security\
**Created:** [20 December 2023 08:54 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860 "2023-12-20T08:54:44Z")\
**Posts on this page:** 1\
**Showing post:** 37

<div class="post-metadata">

**Author:** ![kevinGodell](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kevingodell/32/27040_2.png) [@kevinGodell](https://discourse.nodered.org/u/kevinGodell)\
**Post date:** [21 December 2023 02:16 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/37 "2023-12-21T02:16:37Z")

</div>

If you were using a hashed password, did the hash begin with `$2b$08`? If you must expose anything with a password, then at least hash it with a higher cost. You could probably use 15 or higher on your setup, if you don't mind being slowed down ever so slightly when logging in. The built-in `node-red admin hash-pw` seems to only use 8 rounds, which is a little too low for modern hardware. Hashing the password yourself and using a higher cost won't stop the brute force, but it might slow the baddies and give you a little time to notice the attempt to gain access.

---

_[View the full topic](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860)._