Password Hashes — How They Work, How They’re Hacked, and How to Maximize Security
According to Dashlane, the average user has at least 90 online accounts. We trust these accounts to protect highly sensitive information about our social lives, browsing habits, shopping history, finances and more. The only thing between your information and a malicious attacker is your password. That’s a lot of responsibility for a a few characters of (sometimes) arbitrarily chosen text. So what exactly goes into making passwords secure?
How Password Hashes Work
Most passwords are hashed using a one-way hashing function. Hashing functions take the user’s password and use an algorithm to turn it into a fixed-length of data. The result is like a unique fingerprint, called the digest, that cannot be reversed to find the original input. So, even if someone gets access to the database storing your hash password, there is no key to decrypt it back to its original form.
In general, here’s how hashing systems work when you log in to an account:
- You enter your password
- A hashing function converts your password into a hash
- The generated hash is compared to the hash stored in the database
- If the the generated hash and the stored hash match, you’re granted access to the account. If the generated hash doesn’t match, you get a login error.
Hacking Hashes
Although hashes aren’t meant to be decrypted, they are by no means breach proof. Here’s a list of some popular companies that have had password breaches in recent years:
What techniques do hackers use to hack the allegedly un-hackable? Here are some of the most common ways that password hashes are cracked:
- Dictionary Attacks
- Brute Force Attacks
- Lookup Tables
- Reverse Lookup Tables
*Note the difference between lookup tables and reverse lookup tables. Lookup tables begin with the precomputed password guess hashes, while reverse lookup tables begin with the table of password hashes from the user accounts database.
- Rainbow Tables
Rainbow tables are very similar to reverse lookup tables, except rainbow tables use reduction functions to make significantly smaller lookup tables. The result is a trade-off, where rainbow tables are slower, but require less storage space.
How to Maximize Password Security — As a User:
- Start with a strong password
- The longer the password, the better. A lengthy password is less vulnerable to brute force attacks. Sentences are good.
- Use random words. Less association between the words in your password makes it less vulnerable to dictionary attacks
- Mix in different characters and numbers. Again, this makes you slightly less vulnerable to dictionary attacks.
2. Change up your password from time to time and from app to app
- If a password breach happens with one account, that password hash has been cracked and needs to be changed for every account it’s used on.
How to Maximize Password Security — As a Developer:
- Stay away from SHA-1 or MD5 hashing functions
SHA-1 and MD5 are outdated and have already been targeted by numerous table attacks. They are fast cryptographic functions and are therefore easier to hack.
Better hashing function options are computationally expensive and therefore more difficult to hack. These are some better hashing algorithms that will minimize password security risks in your application:
- Argon2 — Winner of the password hashing competition. Uses a lot of memory, so it’s difficult to attack.
- PBKDF2 — Has no known vulnerabilities after 15 years of extensive use, although it is lower on memory use.
- scrypt — Very safe, but may have some limitations because it was not designed for password storage.
- bcrypt — An adaptive hashing function, can be configured to remain slow and therefore resistant to attacks.
2. Always add Salt
A salt is a random string you can add to the password before hashing. This will transform the password into a completely different string and will thus generate a different hash each time.
The “better” hashing algorithms listed above all add salts, but if you need to use another hashing function, don’t forget the salt.
Sources:
