bad_encryption.js

function encrypt(text, password) {
  const initVect = crypto.randomBytes(16);
  const key = getCipherKey(password);

  const cipher = createCipheriv('aes256', key, initVect);
  const cipherText = cipher.update(text).digest();

  return initVect + ciphertext;
}

encrypt('hello', 'mygr8password');

In what way is this bad?

Hey Cully. "bad" is meant more as "not ideal". This function requires all the data be in memory as opposed to being processed through a stream. I go into more details in the accompanying blog post here. Grep for "Generating an initialization vector" to jump straight to the context for this code snippet.

That's helpful, thanks!