tex: extend hashes section

tex/part-theoretical.tex

@@ -63,9 +63,6 @@ That is, unless the input of the hash function is also known, in which case all
 it takes is hashing the supposed input and comparing the digest with existing
 digests that are known to be digests of passwords.
 
-\\ \textbf{TODO:} ad more on \emph{why} we care and what types of hashes should be
-used (with refs) and why.
-
 
 \n{3}{Types and use cases}
 
@@ -94,13 +91,14 @@ to...secure passwords by hashing them first.
 
 A password hash function, such as \texttt{argon2} or \texttt{bcrypt} are good
 choices for securely storing hashed passwords, namely because they place CPU
-and memory burden on the machine that is computing the digest. They also
-forcefully limit potential parallelism, thus restricting the scale at which an
-exhaustive search could be launched. Additionally, both functions automatically
-\emph{salt} the passwords before hashing them, which means that two exact same
-passwords of two different users will not end up hashing to the same digest
-value, making it that much harder to recover the original, supposedly weak
-user-provided password.
+and memory burden on the machine that is computing the digest, in case of the
+mentioned functions the \emph{hardness} is even configurable to satisfy the
+most possible scenarios. They also forcefully limit potential parallelism, thus
+restricting the scale at which an exhaustive search could be launched.
+Additionally, both functions can automatically \emph{salt} the passwords before
+hashing them, automatically ensuring that two exact same passwords of two
+different users will not end up hashing to the same digest value. That makes it
+much harder to recover the original, supposedly weak user-provided password.
 
 
 \n{3}{Why are hashes interesting}
@@ -113,19 +111,19 @@ hashing or weak parameters be set or the hash function be simply used
 improperly, it sparks even more interest.
 
 Historically, there have also been enough instances of leaked raw passwords
-that anyone with enough interest can additionally put together a neat list of
-most common hashes of the most commonly used passwords.
+that anyone with enough interest had more than enough time to additionally put
+together a neat list of hashes of the most commonly used passwords.
 
 So while a service might not be storing passwords in \emph{plain text}, which
 is a good practice, using a hashing function not designed to protect passwords
 does not offer much additional protection in the case of weak passwords, which
 happen to be the ones that are the most commonly used.
 
-It would seem logical that a service that is not using cryptographic primitives
-like hash functions correctly is more likely to get hacked and have its users'
-passwords or password hashes leaked. Those are often exposed publicly with no
-restrictions on access, and the internet turns out to be serving as a
-storage/medium.
+It would seem only logical that a service that is not using cryptographic
+primitives like hash functions correctly is more likely to get hacked and have
+its users' passwords or password hashes leaked. Those are often exposed
+publicly with no restrictions on access, and the internet turns out to be
+serving as a storage/medium.
 
 That incidentally also means that anyone interested in their own compromise
 monitoring has at least \emph{some} chances of successfully learning about